AI coding tools/GitHub Copilot
Often, but not reliably. NYU researchers prompted Copilot with 89 security-relevant scenarios and found roughly 40% of the 1,689 programs it produced contained vulnerabilities. Separately, Stanford found developers using an AI assistant wrote less secure code than those without one — and were more confident it was secure. That confidence gap is the more dangerous finding.
GitHub Copilot is an inline code-completion assistant that suggests as you type. Copilot completes at the cursor inside existing files, so its output arrives in small increments that are individually easy to accept without much thought.
These are patterns we look for in code produced this way — not flaws in GitHub Copilot itself. Each names the check that finds it.
The NYU study prompted Copilot with scenarios drawn from MITRE's Top 25 weakness list and found roughly 40% of the resulting programs vulnerable. The completions were not obviously wrong — they were plausible code that satisfied the prompt while missing the security property the situation required.
Detected by: SQL string concatenation
Stanford's user study found participants with an AI assistant wrote significantly less secure code and were simultaneously more likely to believe their code was secure. This is why Copilot-assisted code often gets less review rather than more: it feels finished.
Detected by: Unvalidated request input
Completions reflect patterns common in public code, and a great deal of public code demonstrates approaches that were acceptable when written and are not now. Deprecated crypto choices and superseded authentication patterns arrive looking idiomatic.
Detected by: Disabled HTTPS / insecure HTTP
Where a file already contains a configuration block, Copilot will helpfully complete the next entry — including plausible-looking key assignments. A placeholder that reads like a real key is easy to leave in place and hard to spot in review.
Detected by: Hardcoded JWT or Bearer token
Every check named above runs automatically. Free on public repositories, no signup, results in under three minutes — with the file and line for each finding.
In NYU's study, roughly 40% of the 1,689 programs Copilot generated across 89 security-relevant scenarios contained vulnerabilities. That figure describes deliberately security-focused prompts rather than everyday coding, so it is not a rate for all Copilot output — but it does establish that security-sensitive completions need review.
Stanford's study found participants with access to an AI assistant wrote significantly less secure code than those without, and were more likely to believe their code was secure. The productivity gain is real; so is the confidence gap, and the second one is what removes the review the first one makes necessary.
No. The evidence supports reviewing AI-assisted code more carefully, not abandoning the tooling. The practical response is to treat completions in security-relevant paths as drafts and to run automated checks over what was accepted, since those paths are where the measured failure rate concentrates.