Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions. - Pearce, Hammond; Ahmad, Baleegh; Tan, Benjamin; Dolan-Gavitt, Brendan; Karri, Ramesh (Communications of the ACM, 2025)
This research article seeks to exploit vulnerabilities in using Github Copilot for paired human-artificial intelligence code generation. The method employs MITRE’s top 25 Common Weakness Enumeration (CWE) list to evaluate Copilot’s performance in regards to three areas- diversity of weakness, diversity of prompt, and diversity of domain. The discussion of the results includes an overview on threats to validity of the results including CWE and scenario inclusion and reproducibility of code generated.