Study catalogs 1,540 vulnerable functions in AI-assisted C/C++ code

Researchers mined 226 production GitHub repositories and pulled 21,430 functions written with AI assistance in C and C++, then found 1,540 of them vulnerable across 17 distinct CWE categories. The work spans commits from November 2022 through September 2026, tracked through commit metadata and authorship provenance signals, according to the paper posted on arXiv.

That's a different animal than most vulnerability research to date. Prior datasets leaned on human-written code or code generated in controlled prompting setups, neither of which tells you what happens when a model's output gets merged into a real codebase and ships. This one draws from repos where the code was actually merged and deployed.

Each function in the dataset carries repository, commit, function, provenance, and tool metadata. That last field is what makes the thing worth building on: you can slice the 1,540 vulnerable functions by which tool wrote them and start comparing failure patterns tool by tool instead of averaging everything into one score.

The labeling itself leaned on an ensemble of static analysis and pattern matching, with CWE assignment checked against independent manual annotation. The agreement came out to a Cohen's kappa of 0.79, solid but not perfect, so some fraction of those 1,540 labels will be disputable on closer inspection.

For teams merging AI-assisted C/C++ code without a review step built around known CWE patterns, this is the first large sample that shows the failure modes aren't hypothetical. The paper doesn't say whether vulnerability rates differ meaningfully between tools, which is the question this dataset is positioned to eventually answer once someone runs that comparison.