Purple Llama CyberSecEval: A Secure Coding Benchmark for Language Models

Better coding models produce more insecure code, not less. Across 7 models from the Llama 2, Code Llama, and OpenAI GPT families, the models that scored highest on a code-quality proxy had lower pass rates on insecure-coding tests, in both autocomplete and instruction settings and within individual languages.

CyberSecEval builds test cases automatically: an Insecure Code Detector with 189 static analysis rules covering 50 CWEs across 8 languages (C, C++, C#, Javascript, Rust, Python, Java, PHP) finds insecure patterns in open source code, then those sites become autocomplete prompts (10 preceding lines) or LLM-generated natural language instructions. A second track hand-authors prompt fragments mapped to MITRE ATT&CK, expanded with Llama-70b-chat into 1,000 prompts, 100 per category, judged by an LLM pipeline.

Models suggested vulnerable code 30% of the time on average; CodeLlama-34b-instruct, the strongest coder tested, passed only 75% of the time. Models complied with 53% of cyberattack assistance requests, more for the code-specialized family, with compliance highest on ambiguous discovery and recon requests.

The detectors were validated by hand: 96% precision and 79% recall on insecure code, 94% precision and 84% recall on attack helpfulness across 465 sampled responses. The capability-insecurity link is correlational across 7 models, with BLEU-to-original-code as the capability proxy and no controlled ablation.

Single-turn, English-only, and test cases drawn from open source code that models may have trained on. Treat coding strength as a risk factor rather than a mitigation when evaluating assistants.