Security weaknesses of Copilot generated code in GitHub
1–10 of 87 posts
Re: Security weaknesses of Copilot generated code in GitHub
#2"...The results show that (1) 35.8% of Copilot generated code snippets contain CWEs, and those issues are spread across multiple languages, (2) the security weaknesses are diverse and related to 42 different CWEs, in which CWE-78: OS Command Injection, CWE-330: Use of Insufficiently Random Values, and CWE-703: Improper Check or Handling of Exceptional Conditions occurred the most frequently, and (3) among the 42 CWEs identified, 11 of those belong to the currently recognized 2022 CWE Top-25. Our findings confirm that developers should be careful when adding code generated by Copilot (and similar AI code generation tools) and should also run appropriate security checks as they accept the suggested code..."
Re: Security weaknesses of Copilot generated code in GitHub
#3Did they prompt it to consider security weaknesses?
Re: Security weaknesses of Copilot generated code in GitHub
#4If a weakness is common, then of course Copilot is going to suggest it. Copilot gives you popular responses not correct ones. Yet if a weakness is common, it also means that human coders frequently make the same mistake as well.
The studies results are rather unsurprising and its conclusions are oft-repeated advice. As many have said, treat copilot’s code in the same light you would treat a junior programmer’s code.
Re: Security weaknesses of Copilot generated code in GitHub
#5If a weakness is common, then of course Copilot is going to suggest it. Copilot gives you popular responses not correct ones. Yet if a weakness is common, it also means that human coders frequently make the same mistake as well. The studies results are rather unsurprising and its conclusions are oft-repeated advice. As many have said, treat copilot’s code in the same light you would treat a junior programmer’s code.
I wonder if llm are biased towards older, more insecure implementations because there is a higher volume of old code vs new code.
Same thing with the data it is trained on — not all code requires all levels of refinement. Most of the data is probably around average.
Re: Security weaknesses of Copilot generated code in GitHub
#6If a weakness is common, then of course Copilot is going to suggest it. Copilot gives you popular responses not correct ones. Yet if a weakness is common, it also means that human coders frequently make the same mistake as well. The studies results are rather unsurprising and its conclusions are oft-repeated advice. As many have said, treat copilot’s code in the same light you would treat a junior programmer’s code.
I wonder if llm are biased towards older, more insecure implementations because there is a higher volume of old code vs new code. Same thing with the data it is trained on — not all code requires all levels of refinement. Most of the data is probably around average.
I'm not sure that code being newer inherently means it will be more secure
Re: Security weaknesses of Copilot generated code in GitHub
#7Earlier quoted context omitted.
I wonder if llm are biased towards older, more insecure implementations because there is a higher volume of old code vs new code. Same thing with the data it is trained on — not all code requires all levels of refinement. Most of the data is probably around average.
I'm not sure that code being newer inherently means it will be more secure
I don’t think it is a tautology , but I can imagine a cve scanner picking up older code with log4j where newer code may avoid that library altogether, just as an example.
Since there is more older code than newer code would the llm be suspectible to that ?
Re: Security weaknesses of Copilot generated code in GitHub
#8If a weakness is common, then of course Copilot is going to suggest it. Copilot gives you popular responses not correct ones. Yet if a weakness is common, it also means that human coders frequently make the same mistake as well. The studies results are rather unsurprising and its conclusions are oft-repeated advice. As many have said, treat copilot’s code in the same light you would treat a junior programmer’s code.
I wonder if llm are biased towards older, more insecure implementations because there is a higher volume of old code vs new code. Same thing with the data it is trained on — not all code requires all levels of refinement. Most of the data is probably around average.
> Most of the data is probably around average.
I know this is not how distributions work, but I had to chuckle at the literal interpretation of this.
Re: Security weaknesses of Copilot generated code in GitHub
#9Did they prompt it to consider security weaknesses?
That would be kind of wild. Imagine a world where whether your system was secure was just a matter of remembering to tell the AI agent "& also make it secure" before it writes your code.
(could be quite real!)
Re: Security weaknesses of Copilot generated code in GitHub
#10> The results show that (1) 35.8% of Copilot generated code snippets contain CWEs
What percent of non-Copilot generated public GitHub repos contain CWEs?
Edit: According to this study, Copilot generates C/C++ code with vulnerabilities, but at a lower rate than your average human coder: https://arxiv.org/pdf/2204.04741.pdf