Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions.
This research article seeks to exploit vulnerabilities in using Github Copilot for paired human-artificial intelligence code generation. The method employs MITRE’s top 25 Common Weakness Enumeration (CWE) list to evaluate Copilot’s performance in regards to three areas- diversity of weakness, divers...
| Published in: | Communications of the ACM Vol. 68; no. 2; pp. 96 - 106 |
|---|---|
| Main Authors: | , , , , |
| Format: | Article |
| Published: |
Association for Computing Machinery
Feb2025
|
| Subjects: | |
| Online Access: | View this record in EBSCOhost |
| fields | @attributes: recordID: 1 pdfLink: plink: https://search.ebscohost.com/login.aspx?direct=true&db=hlh&AN=182365552&site=ehost-live header: @attributes: shortDbName: hlh uiTerm: 182365552 longDbName: Humanities International Complete uiTag: AN controlInfo: bkinfo: jinfo: jid: 00010782 ACM jtl: Communications of the ACM issn: 00010782 maglogo: N pubinfo: dt: Feb2025 vid: 68 iid: 2 pid: 68 pub: Association for Computing Machinery artinfo: ui: 182365552 10.1145/3610721 ppf: 96 ppct: 10 formats: tig: atl: Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions. aug: au: Pearce, Hammond Ahmad, Baleegh Tan, Benjamin Dolan-Gavitt, Brendan Karri, Ramesh affil: New York University, Department of ECE, New York, NY, USA University of Calgary, Department of ESE, Calgary, Alberta, Canada su: Human-artificial intelligence interaction Computer programming Github Inc. Computer security vulnerabilities Programming languages sug: subj: Human-artificial intelligence interaction Computer programming Github Inc. Computer security vulnerabilities Programming languages ab: This research article seeks to exploit vulnerabilities in using Github Copilot for paired human-artificial intelligence code generation. The method employs MITRE’s top 25 Common Weakness Enumeration (CWE) list to evaluate Copilot’s performance in regards to three areas- diversity of weakness, diversity of prompt, and diversity of domain. The discussion of the results includes an overview on threats to validity of the results including CWE and scenario inclusion and reproducibility of code generated. pubtype: Periodical doctype: Article src: R language: English refInfo: copyright: @attributes: flag: Y dt: @attributes: year: 2025 holdings: @attributes: islocal: N |
|---|