Search papers, labs, and topics across Lattice.
This study empirically investigates the influence of AI code assistants, specifically GitHub Copilot, on developers' use of security APIs, involving 44 professional developers tasked with programming. While the findings indicate that Copilot enhances functional correctness and slightly reduces some insecure coding patterns, it fails to significantly improve secure API usage, with developers often unaware of lingering security vulnerabilities in their implementations. The research highlights a critical gap in security awareness among developers when using AI assistance, prompting recommendations for better security practices and future research directions.
Despite improving functional correctness, AI code assistants like Copilot leave developers blind to security vulnerabilities in their API usage.
AI code assistants are transforming software development, but their implications for software security remain a major concern, particularly in the context of security APIs. These APIs are critical for safeguarding software systems, yet their complexity often leads to incorrect use and serious vulnerabilities. Developing an evidence-based understanding of how AI assistants influence developers'use of these APIs is therefore essential for informing effective mitigation strategies. While a few user studies have examined the broader impact of AI assistants on software vulnerabilities, the use of security APIs remains unexplored from a developer-centered perspective. This study addresses this gap by presenting the first empirical investigation into how AI code assistants affect professional developers'use of security APIs. We conducted a study with 44 developers who completed security API programming tasks with and without GitHub Copilot assistance. Our findings show that, while Copilot improves functional correctness and marginally reduces certain insecure patterns, it does not significantly improve secure API usage. We also found that developers rarely raised security concerns when engaging with Copilot, and many did not recognize that their final implementations remained insecure. Finally, we offer recommendations for enhancing security awareness among developers and propose future research directions to support safer AI-assisted software development.
