SoK: Progress, Pitfalls, and Paths Forward in AI Secure Code Generation

This SoK paper proposes a three-layer framework that systematically reviews the progress, problems, and improvement paths of AI secure code generation, and evaluates multiple models and coding agents on benchmarks covering function-level and full web application security. The framework separately measures models' natural language understanding of secure coding principles, the code-level implementation of these principles when generating code, and the gap between understanding and implementation. Results show that understanding of secure coding principles is a statistically strong predictor of functional correctness, security, and joint functional-security correctness, but models still exhibit a clear knowledge-to-implementation gap, being able to identify relevant principles yet not necessarily generating secure and functionally correct code. Based on this, the authors propose directions such as principle-guided generation, evaluation, benchmark construction, and agent workflows.