Skip to content
Disclaimer

This is a draft discussion paper circulated for peer review. It is independent work published in a personal capacity and does not constitute official guidance or policy of any government body. It does not mandate or recommend specific controls for any agency, system, or project. Views and analysis are the author's own.

Bibliography

References cited in the discussion paper suite, including frameworks, standards, academic literature, and industry sources.

  • Australian Signals Directorate. Information Security Manual. Commonwealth of Australia. December 2025 revision. https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism — Controls referenced: ISM-0401 (Secure by Design), ISM-0402 (SAST/DAST/SCA), ISM-1419 (development environments), ISM-2026/2027/2028 (software artefact integrity), ISM-2060 (code review), ISM-2061 (security-focussed peer review), ISM-2074 (AI usage policy). Individual controls are searchable by number on the ASD website.
  • Australian Signals Directorate. Essential Eight Maturity Model. Commonwealth of Australia. Updated periodically. https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight — (Gap analysis in §6.3)
  • NIST. SP 800-218: Secure Software Development Framework (SSDF), Version 1.1. February 2022. https://csrc.nist.gov/pubs/sp/800-218/final — (Gap analysis in §6.2)
  • NIST. SP 800-218A: Secure Software Development Practices for Generative AI and Dual-Use Foundation Models. 26 July 2024. https://csrc.nist.gov/pubs/sp/800-218a/final — (AI-specific SSDF supplement referenced in §6.2)
  • Microsoft. The STRIDE Threat Model. Microsoft Security Development Lifecycle. Last updated 25 August 2022. https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats — (Framework basis for §3)
  • OASIS. Static Analysis Results Interchange Format (SARIF), Version 2.1.0. March 2020. https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html — (Output format specified in the companion documents)
  • Morrissey, J. Wardline Framework Specification: Semantic Boundary Classification and Enforcement. Companion document to Semantic Defects in AI-Generated Code. Draft v0.2.0, 2026. Distributed with this document suite. — (Language-agnostic specification: authority tier model, pattern rules, severity matrix, governance model, conformance criteria. Referenced throughout §5, §7.2, §8)
  • Morrissey, J. Wardline for Python: Language Binding and Enforcement Design. Companion document to Semantic Defects in AI-Generated Code. Draft v0.2.0, 2026. Distributed with this document suite. — (Python-specific binding: decorator vocabulary, AST scanner design, type system enforcement, runtime structural enforcement. Referenced in §7.2, §8, Appendix A, Appendix E)
  • Morrissey, J. Wardline for Java: Language Binding and Enforcement Design. Companion document to Semantic Defects in AI-Generated Code. Draft v0.2.0, 2026. Distributed with this document suite. — (Java-specific binding: annotation vocabulary, enforcement design. Referenced in §7.2)
  • OWASP. Top 10 for Large Language Model Applications, Version 2025. 2025. https://owasp.org/www-project-top-10-for-large-language-model-applications/ — (Gap analysis in §6.4)
  • OWASP. Secure Coding Practices — Quick Reference Guide. 2010. https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/ — (Gap analysis in §6.4)
  • MITRE. Common Weakness Enumeration (CWE). Version 4.19.1. The MITRE Corporation. https://cwe.mitre.org/ — (Taxonomy comparison in §6.4)
  • MITRE. ATT&CK: Adversarial Tactics, Techniques, and Common Knowledge. The MITRE Corporation. Accessed March 2026. https://attack.mitre.org/ — (Taxonomy comparison in §6.4)
  • McConnell, S. Code Complete: A Practical Handbook of Software Construction. 2nd ed. Microsoft Press, 2004. (Industry defect density data: 15–50 defects per KLOC — §4.1)
  • Senge, P. The Fifth Discipline: The Art and Practice of the Learning Organization. Doubleday/Currency, 1990. (Origin of the "Shifting the Burden" systems archetype — §4.2, Appendix G §G.3)
  • Meadows, D. Thinking in Systems: A Primer. Chelsea Green Publishing, 2008. (Systems dynamics foundations referenced in §4.2, Appendix G §G.4–G.5)
  • Parasuraman, R. and Manzey, D. "Complacency and Bias in Human Use of Automation: An Attentional Integration." Human Factors, 52(3), 381–410, 2010. (Automation bias referenced in §4.2)
  • Perry, N., Srivastava, M., Kumar, D. and Boneh, D. "Do Users Write More Insecure Code with AI Assistants?" ACM CCS, 2023. https://doi.org/10.1145/3576915.3623157 — (AI-assisted developers wrote less secure code while feeling more confident — §4.2)
  • Peng, S. et al. "The Impact of AI on Developer Productivity: Evidence from GitHub Copilot." arXiv preprint, 2023. https://doi.org/10.48550/arXiv.2302.06590 — (Preprint, not peer-reviewed. Controlled study: 55.8% faster task completion — §1.2.1)
  • Cui, Z.K., Demirer, M., Jaffe, S., Musolff, L., Peng, S. and Salz, T. "The Effects of Generative AI on High Skilled Work: Evidence from Three Field Experiments with Software Developers." Management Science, 2025. https://doi.org/10.1287/mnsc.2025.00535; SSRN: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4945566 — (Three field experiments across Microsoft, Accenture, and an anonymous Fortune 100 company; 4,867 developers; pooled 26.08% increase in completed tasks — §1.2.1)
  • Bandara, E. et al. "ASTRIDE: A Security Threat Modeling Platform for Agentic-AI Applications." arXiv preprint, arXiv:2512.04785, December 2025. (Preprint, not peer-reviewed.) https://arxiv.org/abs/2512.04785 — (STRIDE extension for AI agent-specific attacks, referenced in §3.1)
  • Muckin, M. and Fitch, S.C. "A Threat-Driven Approach to Cyber Security." Lockheed Martin Corporation, 2019. https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Threat-Driven-Approach.pdf — (Introduces STRIDE-LM: STRIDE extension adding Lateral Movement, referenced in §3.1)
  • METR (Model Evaluation and Threat Research). "Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity." July 2025. https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/ — (Blog post, not peer-reviewed. RCT: experienced developers predicted 24% faster, believed 20% faster, measured 19% slower — §1.2.1, §4.2)
  • Pichai, S. Alphabet Inc. Q3 2024 Earnings Call transcript, 29 October 2024. https://abc.xyz/investor/events/event-details/2024/2024-q3-earnings-call/ — ("More than a quarter of all new code at Google is generated by AI, then reviewed and accepted by engineers." Referenced in §1.2.1)
  • Wolf, A. "Welcome to the Eternal September of open source. Here's what we plan to do for maintainers." GitHub Blog, 12 February 2026 (updated 13 February 2026). https://github.blog/open-source/maintainers/welcome-to-the-eternal-september-of-open-source-heres-what-we-plan-to-do-for-maintainers/ — Primary source. GitHub's Director of Open Source Programs on the review capacity crisis: "The cost to create has dropped but the cost to review has not." Announces PR access controls, interaction limits, and automated triage. (Referenced in §1.2.2)
  • Ghoshal, A. "GitHub eyes restrictions on pull requests to rein in AI-based code deluge on maintainers." InfoWorld, 4 February 2026. https://www.infoworld.com/article/4127156/github-eyes-restrictions-on-pull-requests-to-rein-in-ai-based-code-deluge-on-maintainers.html — Earlier reporting on events that GitHub later addressed formally in Wolf (12 February 2026, above). GitHub described the problem as a denial-of-service attack on human attention. (Review capacity exhaustion evidence referenced in §1.2.2)
  • Graham-Cumming, J. "Incident report on memory leak caused by Cloudflare parser bug." Cloudflare Blog, 23 February 2017. https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/ — (Buffer over-read, described as "memory leak" in the original post title. Precedent referenced in §1.2.3)
  • Ormandy, T. "Cloudflare Reverse Proxies Are Dumping Uninitialized Memory." Google Project Zero Issue 1139, 19 February 2017. https://bugs.chromium.org/p/project-zero/issues/detail?id=1139 — (Discovery of the Cloudbleed vulnerability referenced in §1.2.3)
  • OWASP. GenAI Security Project. 2024. https://genai.owasp.org/ — (Broader project encompassing LLM applications, agentic AI, and AI-driven applications — §6.4)
  • Python Software Foundation. "PEP 249 — Python Database API Specification v2.0." 1999 (revised 2013). https://peps.python.org/pep-0249/ — (DB-API default transaction semantics referenced in Appendix C)
  • Stenberg, D. "The end of the curl bug-bounty." daniel.haxx.se (curl project blog), 26 January 2026. https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/ — (curl ended its bug bounty programme after AI-generated reports overwhelmed validation capacity — §1.2.2)
  • Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł. and Polosukhin, I. "Attention Is All You Need." Advances in Neural Information Processing Systems 30 (NeurIPS), 2017. https://arxiv.org/abs/1706.03762 — (Foundational transformer architecture paper. The context displacement dynamics discussed in §2.3 and §2.4(f) arise from the finite context window and positional encoding properties of the transformer architecture described in this work.)
  • Wang, J., Huang, Y., Chen, C., Liu, Z., Wang, S. and Wang, Q. "A Taxonomy of Bugs in LLM-Generated Code." Proceedings of the 47th IEEE/ACM International Conference on Software Engineering (ICSE), 2025. https://doi.org/10.1145/3696457.3715696 — (Two-dimensional taxonomy from 558 incorrect solutions across six LLMs. 78.5% of incorrect solutions were compilable and 58.3% were runnable — producing executable code that gives wrong results rather than failing visibly. Referenced in §1.6 as classifying code that fails detectably, complementary to this paper's focus on code that passes all checks.)
  • Gao, Z., Wen, M., Liang, Y., Wang, S. and Liu, Y. "A Comprehensive Survey of Bugs in Large Language Model Generated Code." arXiv preprint, arXiv:2503.16542, 2025. https://arxiv.org/abs/2503.16542 — (Preprint, not peer-reviewed. Comprehensive survey covering bug taxonomies, detection methods, and repair techniques for LLM-generated code. Their "semantic bug" category — code that is syntactically and structurally correct but behaviourally wrong — is the closest existing category to the ACF taxonomy's territory, but does not develop the institutional-context dimension. Referenced in §1.6.)
  • Lohn, A.J. and Jackson, K. "Will AI Make Cyber Swords or Shields? A Few Early Observations." Center for Security and Emerging Technology (CSET), Georgetown University, September 2024. https://cset.georgetown.edu/publication/will-ai-make-cyber-swords-or-shields/ — (Policy-level risk categorisation of AI-generated code: insecure code patterns, over-reliance on AI output, and supply chain concerns. Identifies broad risk categories without developing a structured failure taxonomy. Referenced in §1.6.)
  • Chen, J., Hu, J., Huang, J., Wang, J., Zhang, H. and Chen, T.H. "A Survey on Large Language Models for Code Security." arXiv preprint, arXiv:2412.15004, 2024. https://arxiv.org/abs/2412.15004 — (Preprint, not peer-reviewed. Systematic literature review covering 67 papers on security vulnerabilities, adversarial attacks, and defensive techniques across the code language model lifecycle. Referenced in §1.6.)
  • Open Source Security Foundation (OpenSSF). "Secure AI Coding Practices." OpenSSF Best Practices Working Group, 2025. https://best.openssf.org/Secure-AI-Coding-Practices — (Security-focussed system prompts, instruction templates, and workflow recommendations for AI code assistants. Addresses the generation-time control layer that is complementary to this paper's integration-boundary controls — see §1.6.)
  • Meyer, B. Object-Oriented Software Construction. 2nd ed. Prentice Hall, 1997. — (Origin of the Design by Contract methodology. The paper's concept of machine-enforceable semantic correctness properties — encoding what code must do in forms that tools can verify — has intellectual heritage in Meyer's preconditions, postconditions, and class invariants. Referenced implicitly throughout §7.2.)
  • Leveson, N.G. Engineering a Safer World: Systems Thinking Applied to Safety. MIT Press, 2011. https://direct.mit.edu/books/oa-monograph/2908/Engineering-a-Safer-World-Systems-Thinking-Applied — (Systems-theoretic approach to safety in complex sociotechnical systems. The paper's "control law" metaphor is borrowed from the fly-by-wire aviation domain that Leveson analyses extensively. Referenced in §1.3, §8.6, Appendix G §G.1. Open access.)
  • Geer, D., Bace, R., Gutmann, P., Metzger, P., Pfleeger, C.P., Quarterman, J.S. and Schneier, B. "CyberInsecurity: The Cost of Monopoly — How the Dominance of Microsoft's Products Poses a Risk to Security." Computer and Communications Industry Association, September 2003. https://ccianet.org/wp-content/uploads/2003/09/cyberinsecurity%20the%20cost%20of%20monopoly.pdf — (The foundational argument that software monoculture creates systemic correlated failure risk. The paper's model monoculture analysis in §2.4(g) and Appendix F extends this argument from operating system homogeneity to AI model training-lineage homogeneity.)
  • SKYbrary. "Flight Control Laws." SKYbrary Aviation Safety, EUROCONTROL. https://skybrary.aero/articles/flight-control-laws — (Reference for the Airbus A320 normal law / alternate law / direct law framework that the paper's "control law" terminology borrows — see §1.3, Appendix H.)

This is a discussion paper. It presents a threat model and preliminary analysis, not final guidance. Comments and contributions are welcome.

Suggested citation: Morrissey, J. "Semantic Defects in AI-Generated Code: Assurance Frameworks for AI-Assisted Development in High-Stakes Code Paths." Discussion Paper, Draft for Comment v0.1.0, 24 March 2026.