arXiv: The Language of Security: How Prompt Syntax Shapes Secure Code Generation in Open LLMs

This paper, published on arXiv, presents a study on how the phrasing of prompts given to open-source large language models (LLMs) directly affects the security of the code they generate. It demonstrates that subtle changes in prompt syntax can significantly increase or decrease the likelihood of introducing vulnerabilities, such as SQL injection or buffer overflows. While not a regulatory change itself, this research provides critical evidence for regulators and compliance teams that the security of AI-generated code is not solely a model capability issue but a prompt engineering and governance one.

The findings are most relevant to any organization deploying open LLMs for code generation, particularly in the financial, healthcare, and critical infrastructure sectors subject to strict software security requirements under frameworks like the EU AI Act or NIS2. Software vendors, internal development teams, and AI service providers must now consider prompt design as a material control point for compliance, not just a usability feature.

Compliance teams should immediately review their AI governance policies to include mandatory prompt syntax testing and validation for any LLM used in code production. They should also update their risk assessment templates to account for prompt-induced vulnerabilities and ensure that developer training covers secure prompt engineering. Finally, teams should monitor regulatory guidance from ENISA and national authorities, as this research may inform future binding technical standards for AI safety.