AI ASSISTANTS IN SOFTWARE DEVELOPMENT: ANALYSIS OF SECURITY RISKS IN GENERATED CODE

Dmytro Boichuk

doi:10.36074/grail-of-science.01.05.2026.077

AI ASSISTANTS IN SOFTWARE DEVELOPMENT: ANALYSIS OF SECURITY RISKS IN GENERATED CODE

Authors

Dmytro Boichuk TD Bank, Toronto, Canada https://orcid.org/0009-0007-7391-1517

DOI:

https://doi.org/10.36074/grail-of-science.01.05.2026.077

Keywords:

AI assistants, GitHub Copilot, LLM, code security, vulnerabilities, static analysis, DevSecOps, generative AI, code review, cybersecurity

Summary

This article examines the widespread adoption of AI coding assistants in software development and the security risks that accompany this shift. It analyzes characteristic vulnerability patterns in code generated by tools such as GitHub Copilot, Amazon CodeWhisperer, and similar large language model (LLM) based systems. The paper reviews quantitative academic research confirming elevated vulnerability rates in AI-generated code across categories including injection attacks, cryptographic errors, data leakage, and broken access control. Practical approaches are proposed for integrating AI tools into a secure development lifecycle, encompassing static analysis tooling, security-aware prompting, structured code review, and team education. The article is addressed to software developers, system architects, and cybersecurity professionals.

Downloads

PDF

Downloads

Download data is not yet available.

License

References

GitHub. (2024). The state of open source and AI. GitHub Octoverse Report. https://github.blog/news-insights/research/the-state-of-open-source-and-ai/

Amazon Web Services. (2023). Amazon CodeWhisperer: Productivity challenge results. AWS Machine Learning Blog. https://aws.amazon.com/blogs/machine-learning/amazon-codewhisperer-free-for-individual-use-is-now-generally-available/

Pearce, H., Ahmad, B., Tan, B., Dolan-Gavitt, B., & Karri, R. (2022). Asleep at the keyboard? Assessing the security of GitHub Copilot's code contributions. 2022 IEEE Symposium on Security and Privacy (SP), 754–768. https://doi.org/10.1109/SP46214.2022.9833571 DOI: https://doi.org/10.1109/SP46214.2022.9833571

Asare, O., Nagappan, M., & Asokan, N. (2023). Is GitHub's Copilot as bad as humans at introducing vulnerabilities in code? Empirical Software Engineering, 28(6), 129. https://doi.org/10.1007/s10664-023-10354-5 DOI: https://doi.org/10.1007/s10664-023-10380-1

Schuster, R., Song, C., Tromer, E., & Shmatikov, V. (2021). You autocomplete me: Poisoning vulnerabilities in neural code completion. 30th USENIX Security Symposium, 1487–1504.

Perry, N., Srivastava, M., Kumar, D., & Boneh, D. (2023). Do users write more insecure code with AI assistants? Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2785–2799. https://doi.org/10.1145/3576915.3623157 DOI: https://doi.org/10.1145/3576915.3623157

Sonar. (2024). The 2024 Clean Code report: AI-assisted development trends. SonarSource Research. https://www.sonarsource.com/resources/clean-code-report/

Sandoval, G., Pearce, H., Nys, T., Karri, R., Garg, S., & Dolan-Gavitt, B. (2023). Lost at C: A user study on the security implications of large language model code assistants. 32nd USENIX Security Symposium, 2205–2222.

OWASP Foundation. (2021). OWASP Top 10:2021 — The ten most critical web application security risks. https://owasp.org/Top10/

MITRE. (2024). Common Weakness Enumeration (CWE) — Top 25 Most Dangerous Software Weaknesses. https://cwe.mitre.org/top25/