MAPPING SECURITY RISKS AND MITIGATION STRATEGIES IN AIR ASSISTED SOFTWARE DEVELOPMENT ACROSS THE SOFTWARE DEVELOPMENT LIFECYCLE

Abstract

AI-assisted development creates a security problem that extends beyond whether generated code compiles: developers must judge the reliability of recommendations, dependencies, analyses, and repairs. Prior reviews already synthesize generated-code weaknesses, attacks and defenses for code language models, secure prompting, and threats across software and LLM lifecycles. This study therefore advances a narrower contribution: a claim-level evidence chain connecting an AI-assisted application-development activity and its software-development-lifecycle (SDLC) stage to the reported risk, vulnerability, mitigation, evaluation design, security and functional outcomes, and residual uncertainty. We specify a systematic-review protocol for peer-reviewed studies first published from 1 January 2020 through 12 September 2026. A purposively assembled set of thirteen primary studies is used only to pilot the framework; it is not the final systematically screened corpus. The pilot identifies insecure generation, poisoning, package hallucination, indirect prompt injection, unreliable detection and repair, and over-reliance on assistant output. Comparative studies support some prompting, learned-prefix, retrieval, fine-tuning, and repair strategies within their tested settings, while also showing that improvement in a security proxy may coexist with reduced functional correctness. All quantitative visuals are restricted to auditable pilot mappings or values reported in an individual source. Database exports, independent screening, completed appraisal, and full-version reconciliation remain prerequisites for presenting this work as a completed systematic literature review.