LLM + Security = Trouble

The paper argues that the "fight fire with fire" route of hardening AI-generated code with AI checkers cannot cover long-tail security vulnerabilities, and systems may still be exposed to zero-day vulnerabilities. Neurosymbolic methods (LLM + formal methods) are difficult to integrate into vibe coding workflows, and the human verification step easily becomes a weak point. The authors argue for enforcing security constraints at code generation time via constrained decoding, rather than relying only on post-hoc detection and repair, and state that this is especially promising for diffusion-based code models.