Devs to Anthropic, OpenAI, Cursor, and friends: Make security and privacy the default

Researchers from York University and the University of Calgary in Canada have examined developers' concerns about AI coding tools like Claude Code, Cursor, GitHub Copilot, and OpenAI Codex. Their study, published in a preprint paper titled "Impossible to hide secret …: Uncovering Security and Privacy Issues in LLM-native IDEs," reveals a range of issues related to security and privacy in these tools.

The research team identified 446 Reddit posts and over 6,000 comments, leading to a taxonomy of security and privacy issues faced by developers. Unauthorized file operations, unsafe code execution, and unexpected code modifications were among the most common problems. Unauthorized file operations accounted for 43.1% of security-related posts, with LIDEs often removing project directories or files without permission. Unsafe code execution, which involved executing scripts without user consent, was found in 0.6% of cases.

Operational safety issues, such as LIDEs accidentally deploying code to production, made up 23.9% of the security-related posts. Unsafe code generation, where AI tools produced code with errors or vulnerabilities, accounted for 18.2% of issues. Privacy concerns were also prevalent, with 194 posts mentioning lack of transparency and unauthorized data access.

Lack of clear information about data collection, retention, and transmission was a significant issue (45.9%), while unauthorized data collection and transmission occurred in 11.9% of cases.