# Do AI coding assistants make code less secure?

In one study, yes: developers using an AI assistant wrote insecure code more often and were more confident it was secure.

Evidence: Limited (Early signal, treat it as a hypothesis) · LLM fit: High (Tested on LLM products) (https://aiuxevidence.com/how-we-rate)
One small controlled study with a real code assistant, plus a highlighting study.

## Design it like this

Flag security-sensitive suggestions and prompt review, especially for overconfident users.

- Treat AI-written security code as unreviewed. [from the study]
- Warn on security-sensitive patterns (crypto, auth, input handling). [our reading]
- Highlight lines likely to need edits to focus review. [from the study]
- Don't let assistant use increase confidence without checks. [from the study]

## What they found

### Perry et al. (2023), experiment

47 participants did five security-related programming tasks in Python, JavaScript and C, with or without an AI code assistant. Those with the assistant wrote insecure solutions more often on four of the five tasks, and were more likely to believe their code was secure.

> “Participants with access to an AI assistant were also more likely to believe they wrote secure code, suggesting that such tools may lead users to be overconfident about security flaws in their code.” (Abstract)

### Vasconcelos et al. (2024), experiment

Mixed-methods study with 30 programmers comparing code completions with no highlighting, highlighting the lowest-probability tokens, or highlighting tokens most likely to be edited. Highlighting likely-to-be-edited tokens led to faster task completion and more targeted edits and was preferred; highlighting by generation probability gave no benefit over no highlighting.

> “highlighting tokens according to their probability of being generated does not provide any benefit over the baseline with no highlighting” (Abstract)

## Trade-offs and when it doesn't apply

- 47 participants; newer assistants may differ.
- Security outcomes vary by language and task.
- More warnings slow development.

## What it looks like

- Do: An assistant that tags generated auth code “security-sensitive: review” and links to guidance.
- Don't: Silent insertion of a full encryption routine.

## How to check it in your product

Run static analysis on AI-assisted commits vs. others and compare vulnerability rates.

## Open questions

- Do newer coding agents still show this pattern?
- Which warnings reduce overconfidence?
- Does pairing AI with security linters fix it?

## FAQ

### Do developers write less secure code with AI?

In Perry et al. (47 participants), those with an AI assistant wrote insecure solutions more often on four of five tasks.

### Are they aware of it?

No. They were more likely to believe their code was secure.

## Related questions

- [Does relying on AI reduce users' critical thinking?](https://aiuxevidence.com/e/deskilling)
- [Do inline AI suggestions like Copilot cost users time?](https://aiuxevidence.com/e/inline-suggestions)
- [Should AI highlight the parts of its output it's unsure about?](https://aiuxevidence.com/e/highlight-uncertainty)

## Sources

1. Neil Perry, Megha Srivastava, Deepak Kumar, Dan Boneh (2023). Do Users Write More Insecure Code with AI Assistants?. CCS 2023. https://doi.org/10.1145/3576915.3623157
2. Helena Vasconcelos, Gagan Bansal, Adam Fourney, Q. Vera Liao, Jennifer Wortman Vaughan (2024). Generation Probabilities Are Not Enough: Uncertainty Highlighting in AI Code Completions. ACM TOCHI (preprint, arXiv:2302.07248v3, Nov 2024). https://doi.org/10.1145/3702320

Canonical: https://aiuxevidence.com/e/code-security