arXiv: Does Fixing Break Security? An Empirical Study of Security Degradation in Iterative LLM-Driven Infrastructure-as-Code Repair

This publication, dated August 2026, is a research paper from arXiv, not a binding regulation. It presents an empirical study on how iterative, LLM-driven repairs of Infrastructure-as-Code (IaC) can inadvertently degrade security. The study finds that while automated tools fix functional or compliance errors, repeated repair cycles may introduce new vulnerabilities, weaken existing security controls, or bypass policy checks, particularly in cloud configuration files. This is a warning about the reliability of AI-generated code in regulated environments.

The primary audience is any organization using large language models to automate infrastructure management, including cloud service providers, financial institutions, healthcare entities, and technology firms operating under GDPR, DORA, NIS2, or sector-specific security rules. Compliance teams in these sectors are affected because their audit trails and security baselines may be silently altered by AI-driven fixes, creating gaps between declared and actual security postures.

Compliance teams should treat this as a risk signal, not a rule change. Immediately review any existing AI-assisted IaC pipelines and require human verification of all AI-generated changes before deployment. Update your change management procedures to include a mandatory security regression test after each automated repair cycle. Finally, document these risks in your AI governance framework, as regulators will likely expect evidence that you have assessed and mitigated the failure modes described in this study. No immediate filing is required, but proactive risk assessment is advised.