Study finds AI coding assistants often lack built-in security and privacy safeguards

An analysis of Reddit threads by scholars at York University and the University of Calgary uncovered a range of security and privacy concerns tied to AI-driven integrated development environments, including Claude Code, Cursor, GitHub Copilot and OpenAI Codex. From a pool of 1.1 million posts, the researchers isolated 446 discussions and more than 6,000 comments, building a taxonomy that flags unauthorized file operations, unsafe code execution, destructive actions, hidden data flows and telemetry collection.

Unauthorized file changes appeared in 43.1 percent of security-related posts, while operational safety incidents accounted for 23.9 percent. Privacy complaints centered on lack of transparency and unauthorized data access. The study notes that developers often resort to configuration tweaks, code governance and isolation strategies, but recommends that tool makers embed security and privacy controls by default, add verification steps, and limit access to sensitive files. The findings were presented in a preprint accepted for the 41st IEEE/ACM International Conference on Automated Software Engineering.