This research reveals critical security flaws in Retrieval-Augmented Code Generation (RACG) systems when knowledge bases contain vulnerable code examples.

• Knowledge Base Poisoning can be exploited to introduce vulnerabilities into generated code
• Even small amounts of vulnerable examples (5-10%) can significantly compromise code security
• Current systems lack effective defenses against this attack vector
• Proposed mitigation strategies include improved filtering and detection mechanisms

Why it matters: As organizations increasingly adopt AI assistants for code generation, understanding these security threats is essential for preventing the proliferation of vulnerable software.

Exploring the Security Threats of Knowledge Base Poisoning in Retrieval-Augmented Code Generation