We generated 1,689 programs across 89 scenarios and found approximately 40% to be vulnerable.
Curated from arxiv.org · 16 December 2021 →
The first systematic security study of an AI coding assistant, run at NYU while GitHub Copilot was still in preview. The team built scenarios where MITRE's twenty-five most dangerous software weaknesses were possible, let Copilot complete them, and analysed the output: about two in five programs carried a vulnerability. The paper is careful about what that does and does not mean, since the same figure would not be flattering for human code either, and its more useful finding is the second one: the security of a completion depends heavily on how the surrounding code is written, so a developer whose own file is already sloppy gets worse suggestions. Published in 2021 and cited in almost every argument about this since.
