Large Language Models (LLMs) have emerged as powerful tools for automating programming tasks, including security-related ones. However, they can also introduce vulnerabilities during code generation, fail to detect existing vulnerabilities, or report nonexistent ones. This systematic literature review investigates the security benefits and drawbacks of using LLMs for code-related tasks. In particular, it focuses on the types of vulnerabilities introduced by LLMs when generating code. Moreover, it analyzes the capabilities of LLMs to detect and fix vulnerabilities, and examines how prompting strategies impact these tasks. Finally, it examines how data poisoning attacks impact LLMs performance in the aforementioned tasks.

翻译：大型语言模型（LLMs）已成为自动化编程任务（包括安全相关任务）的强大工具。然而，它们在代码生成过程中也可能引入漏洞，无法检测现有漏洞，或报告不存在的漏洞。本系统性文献综述研究了使用LLMs处理代码相关任务的安全益处与缺陷。特别地，它聚焦于LLMs生成代码时所引入的漏洞类型。此外，本文分析了LLMs检测与修复漏洞的能力，并考察了提示策略如何影响这些任务。最后，本文探讨了数据投毒攻击如何影响LLMs在上述任务中的表现。