Do AI coding assistants make code less secure?
In one study, yes: developers using an AI assistant wrote insecure code more often and were more confident it was secure.
One small controlled study with a real code assistant, plus a highlighting study.
experiment2 of 2 tested with LLMsEvidence from 2023–2024How we rateFlag security-sensitive suggestions and prompt review, especially for overconfident users.
- Treat AI-written security code as unreviewed.From the study
- Warn on security-sensitive patterns (crypto, auth, input handling).Our reading
- Highlight lines likely to need edits to focus review.From the study
- Don't let assistant use increase confidence without checks.From the study
What they found
Perry et al. (2023)experiment
47 participants did five security-related programming tasks in Python, JavaScript and C, with or without an AI code assistant. Those with the assistant wrote insecure solutions more often on four of the five tasks, and were more likely to believe their code was secure.
“Participants with access to an AI assistant were also more likely to believe they wrote secure code, suggesting that such tools may lead users to be overconfident about security flaws in their code.”
Perry et al., 2023 · Abstract
Vasconcelos et al. (2024)experiment
Mixed-methods study with 30 programmers comparing code completions with no highlighting, highlighting the lowest-probability tokens, or highlighting tokens most likely to be edited. Highlighting likely-to-be-edited tokens led to faster task completion and more targeted edits and was preferred; highlighting by generation probability gave no benefit over no highlighting.
“highlighting tokens according to their probability of being generated does not provide any benefit over the baseline with no highlighting”
Vasconcelos et al., 2024 · Abstract
Trade-offs and when it doesn't apply
- 47 participants; newer assistants may differ.
- Security outcomes vary by language and task.
- More warnings slow development.
What it looks like
How to check it in your product
Run static analysis on AI-assisted commits vs. others and compare vulnerability rates.
Open questions
- Do newer coding agents still show this pattern?
- Which warnings reduce overconfidence?
- Does pairing AI with security linters fix it?
FAQ
Do developers write less secure code with AI?
In Perry et al. (47 participants), those with an AI assistant wrote insecure solutions more often on four of five tasks.
Are they aware of it?
No. They were more likely to believe their code was secure.
Sources
- Do Users Write More Insecure Code with AI Assistants?Neil Perry, Megha Srivastava, Deepak Kumar, Dan Boneh (2023). CCS 2023.
- Generation Probabilities Are Not Enough: Uncertainty Highlighting in AI Code CompletionsHelena Vasconcelos, Gagan Bansal, Adam Fourney, Q. Vera Liao, Jennifer Wortman Vaughan (2024). ACM TOCHI (preprint, arXiv:2302.07248v3, Nov 2024).