Security Vulnerabilities in AI-Generated Code: A Large-Scale Analysis of Public GitHub Repositories
Open accessThe claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Even when AI-generated code passes functional tests, it often embeds latent security weaknesses and maintainability issues that shift effort from development to downstream debugging and remediation, effectively accumulating technical debt.
“Schreiber and Tippe (2025) show that even when AI-generated code passes functional tests, it often embeds latent security weaknesses and maintainability issues that shift effort from development to downstream debugging and remediation, effectively accumulating technical debt.”
From AI-Assisted Programming Decreases the Productivity of Experienced Developers by Increasing the Technical Debt and Maintenance Burden (2025) · cites this paper as Schreiber and Tippe 2025
Section 5.2 (Practical Implications; page unavailable) says AI tools can rapidly generate functional code while introducing code-quality issues, maintenance challenges, and technical debt. Section 4.3 (CodeQL Analysis; page unavailable) reports security findings and quality recommendations. The paper does not establish that the analyzed code passed functional tests or measure a shift in effort to downstream debugging and remediation. (LLM, conf=0.87)
Experimental — accuracy not yet measuredAI-assisted programming encourages rapid iteration and experimentation, but can shift attention away from longer-term concerns such as maintainability, readability, and alignment with existing system design.
“By lowering the cost of producing code, AI-assisted programming encourages rapid iteration and experimentation, but can shift attention away from longer-term concerns such as maintainability, readability, and alignment with existing system design (Barrett et al. 2023, Schreiber and Tippe 2025).”
From AI-Assisted Programming Decreases the Productivity of Experienced Developers by Increasing the Technical Debt and Maintenance Burden (2025) · cites this paper as Schreiber and Tippe 2025
Section 5.2, Practical Implications (page unavailable), says AI tools can rapidly generate functional code but may create maintenance challenges through unnecessary complexity and technical debt. It does not establish that lower code-production costs encourage iteration and experimentation, or that developers shift attention away from readability and alignment with existing system design. (LLM, conf=0.86)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Do Users Write More Insecure Code with AI Assistants?
Perry, N., Srivastava, M., Kumar, D., & Boneh, D. (2023) · Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3576915.3623157 · Cited by 259 · see citing works
Asleep at the keyboard? Assessing the security of GitHub copilot’s code contributions
Pearce, H., Ahmad, B., Tan, B., Dolan-Gavitt, B., & Karri, R. (2025) · Communications of the ACM · doi:10.1145/3610721 · Cited by 140 · cited 1× · see citing works
“Hammond et al. [13] and Khoury et al. [9] examined GitHub Copilot and ChatGPT respectively using this approach with CodeQL for static analysis.”
Do Users Write More Insecure Code with AI Assistants?
Perry, N., Srivastava, M., Kumar, D., & Boneh, D. (2022) · arXiv · cited 1×
“Perry et al. [14] found that participants using Codex introduced more security vulnerabilities while expressing higher confidence in their solutions compared to a control group.”
Flagged first, then by citations
Research works printed but not linked: 8
- Austin, J., Odena, A., Nye, M., Bosma, M., Michalewski, H., Dohan, D., Jiang, E., Cai, C., Terry, M., Le, Q., Sutton, C.: Program synthesis with large language models (2021), https://arxiv.org/abs/2108.07732 · arXiv
- Copeland, B.J.: Alan Turing's Electronic Brain: The Struggle to Build the ACE, the World's Fastest Computer. Oxford University Press, Oxford (2012)
- Fu, Y., Liang, P., Tahir, A., Li, Z., Shahin, M., Yu, J., Chen, J.: Security weaknesses of copilot-generated code in github projects: An empirical study. ACM Trans. Softw. Eng. Methodol. (Feb 2025)
- Khoury, R., Avila, A.R., Brunelle, J., Camara, B.M.: How secure is code gener- ated by chatgpt? In: 2023 IEEE International Conference on Systems, Man, and Cybernetics (SMC). pp. 2445-2451 (2023)
- Lipp, S., Banescu, S., Pretschner, A.: An empirical study on the effectiveness of static c code analyzers for vulnerability detection. In: Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis. pp. 544- 555. ISSTA 2022, Association for Computing Machinery, New York, NY, USA (2022)
- Sandoval, G., Pearce, H., Nys, T., Karri, R., Garg, S., Dolan-Gavitt, B.: Lost at c: a user study on the security implications of large language model code assistants. In: Proceedings of the 32nd USENIX Conference on Security Symposium. SEC '23, USENIX Association, USA (2023)
- Sarkar, A., Gordon, A.D., Negreanu, C., Poelitz, C., Srinivasa Ragavan, S., Zorn, B.: What is it like to program with artificial intelligence? In: Proceedings of the 33rd Annual Conference of the Psychology of Programming Interest Group (PPIG 2022) (Sep 2022)
- Yetiştiren, B., Özsoy, I., Ayerdem, M., Tüzün, E.: Evaluating the code quality of ai-assisted code generation tools: An empirical study on github copilot, amazon codewhisperer, and chatgpt (2023), https://arxiv.org/abs/2304.10778 · arXiv
Cited by
Sorted by citations
Xu, F., Medappa, P. K., Tunc, M. M., Vroegindeweij, M., & Fransoo, J. C. (2025) · arXiv · doi:10.48550/arxiv.2510.10165 · Cited by 1 · see citing works
- Authors
- Schreiber, M., & Tippe, P.
- Affiliations
- FernUniversität in Hagen (DE)
- Corresponding author
- Tippe, Pascal
- ORCID
- Tippe, Pascal
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer Nature Singapore
- Published
- 2025-10-20
- Pages
- 153-172
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- OpenAlex
- W4415341336
- Cited by
- 6
- References
- 3
- Citations by year
- 2026: 6
- FWCI
- 7.20
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- Lecture notes in computer science (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
- Keywords
- AI-generated code, software vulnerabilities, Common Weakness Enumeration, GitHub Copilot, ChatGPT, static code analysis, software maintainability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
