AI, LLM create unsecure software

First: AI, LLM are a very powerful tool for software developers. 

The following lines will indicate a limit of LLM in software development. 

So you aware of it and can handle it right. 

I found this problem by incident. LLM like qwen3-coder:30b generating code that uses outdated libs and frameworks containing CVE's. 

 

Conclusions 

1.  LLM's are not perfect writing code but don't drop it.
2. Many (Most, All) LLM's living in the past.
3.  LLM's  generate projects with outdated vulnerable dependencies. Be aware of it.  This will time problem will affect all ideas the LMM is generating.

Test

 The task: create a Spring Boot web app with qwen3-coder:30b (ollama, aider) 

1. pom.xml contains Spring Boot Starter Parent 2.7.0, uh that's a little bit outdated
2. Release date was May 19, 2022
3. contains at least 10 CVEs
4. Select Java 11 

Ok, I give a helping hand 

1. Task: create a spring boot web app, spring boot 4 
2. pom.xml contains Spring Boot Starter Parent 3.2.0, uh that's a little bit less outdated
3. Release date was November 23, 2023
4. contains at least 2 CVEs
5. Select Java 17

Looks that the model is living in the past, at least 2 years. So I give are more modern model a try: qwen3.6:27b 

1. Task: create a spring boot web app, spring boot 4  
2. pom.xml contains Spring Boot Starter Parent 3.3.0, best I can get but still far away, gives me a hint to 4.0.0-M1 
3. Release date was May 23, 2024 
4. contains at least 7 CVEs 
5. Select Java 17