Using AI Assistants in Software Development: A Qualitative Study on Security Practices and Concerns. -
Open accessAbstract
Following the recent release of AI assistants, such as OpenAI's ChatGPT and GitHub Copilot, the software industry quickly utilized these tools for software development tasks, e.g., generating code or consulting AI for advice. While recent research has demonstrated that AI-generated code can contain security issues, how software professionals balance AI assistant usage and security remains unclear. This paper investigates how software professionals use AI assistants in secure software development, what security implications and considerations arise, and what impact they foresee on secure software development. We conducted 27 semi-structured interviews with software professionals, including software engineers, team leads, and security testers. We also reviewed 190 relevant Reddit posts and comments to gain insights into the current discourse surrounding AI assistants for software development. Our analysis of the interviews and Reddit posts finds that despite many security and quality concerns, participants widely use AI assistants for security-critical tasks, e.g., code generation, threat modeling, and vulnerability detection. Their overall mistrust leads to checking AI suggestions in similar ways to human code, although they expect improvements and, therefore, a heavier use for security tasks in the future. We conclude with recommendations for software professionals to critically check AI suggestions, AI creators to improve suggestion security and capabilities for ethical security tasks, and academic researchers to consider general-purpose AI in software development.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Other studies consistently highlight the importance of maintaining vigilant security reviews to prevent security issues.
“We note that other studies also consistently highlight the importance of maintaining vigilant security reviews to prevent security issues (e.g. [21, 43]).”
From My Code Is Less Secure with Gen AI: Surveying Developers' Perceptions of the Impact of Code Generation Tools on Security (2025) · cites this paper as [21]
Literature shows generated code is frequently vulnerable and software professionals are wary about this.
“The prominent concern of our participants about vulnerabilities aligns with the literature showing that generated code is frequently vulnerable [9, 31] as well as software professionals being wary about this [21].”
From My Code Is Less Secure with Gen AI: Surveying Developers' Perceptions of the Impact of Code Generation Tools on Security (2025) · cites this paper as [21]
The study independently confirms Klemmer et al. [21].
“Thus, our work independently confirms [21].”
From My Code Is Less Secure with Gen AI: Surveying Developers' Perceptions of the Impact of Code Generation Tools on Security (2025) · cites this paper as [21]
Using a different instrument (quantitative survey), the study comes to some similar conclusions compared to Klemmer et al. [21], which used qualitative methods.
“Using a different instrument (quantitative survey) we come to some similar conclusions compared to [21], which used qualitative methods.”
From My Code Is Less Secure with Gen AI: Surveying Developers' Perceptions of the Impact of Code Generation Tools on Security (2025) · cites this paper as [21]
These studies confirm that, although there are security and quality concerns, software professionals widely use GAI tools.
“These studies confirm that, although there are security and quality concerns, software professionals widely use GAI tools.”
From My Code Is Less Secure with Gen AI: Surveying Developers' Perceptions of the Impact of Code Generation Tools on Security (2025) · cites this paper as [21]
The citation lists haven’t been fetched yet
References 22 · Cited by 41
- Authors
- Klemmer, J. H., Horstmann, S. A., Patnaik, N., Ludden, C., Burton, C., Powers, C., Massacci, F., Rahman, A., Votipka, D., Lipford, H. R., Rashid, A., Naiakshina, A., & Fahl, S.
- Affiliations
- Helmholtz Center for Information Security (DE)
- Ruhr University Bochum (DE)
- University of Bristol (GB)
- Tufts University (US)
- University of Trento (IT)
- Auburn University (US)
- University of North Carolina at Charlotte (US)
- ORCID
- Venue
- Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2024-12-02
- Pages
- 2726-2740
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W4396882206
- Cited by
- 41
- References
- 22
- Citations by year
- 2026: 28 · 2025: 10 · 2024: 3
- FWCI
- 15.58
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Iris (University of Trento) (submittedVersion, other-oa)
- Bristol Research (University of Bristol) (submittedVersion, cc-by)
- VU Research Portal (submittedVersion, other-oa)
- arXiv (Cornell University)
- CISPA Helmholtz Center (cc-by)
- Funders
- NWO, Dutch Research Organization - Kennis- en Innovatieconvenant (KIC) (KICH1.VE01.20.004)
- Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) (Germany's Excellence Strategy - EXC 2092 CASA - 390781972)
- NSF (National Science Foundation) (2247141,2312321)
- EPSRC (EP/V011189/1,EP/W025361/1)
- European Union Horizon Europe program (101120393)
- VolkswagenStiftung (Niedersächsisches Vorab ? ZN3695)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Keywords
- AI assistants, secure software development, AI-generated code, code generation, GitHub Copilot, ChatGPT, threat modeling, vulnerability detection, software security, security testing, developer perceptions
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
