研究AI编程助手对安全API使用的影响,发现其未能显著提升安全性。
Understanding the Impact of AI Code Assistants on Security API Usage: An Empirical Study

- 通过44名开发者实验,对比有无Copilot时的安全API使用情况。
- Copilot提升功能正确性但未显著减少不安全模式,仅12%代码实现安全。
- 开发者极少关注安全问题,多数未意识到最终代码仍不安全。
AI编程助手正重塑软件开发,但其对软件安全的影响仍是重大关切,尤其在安全API领域。这些API对保护系统至关重要,但因复杂性常被误用,导致严重漏洞。本文首次从开发者视角开展实证研究,分析AI助手对专业开发者使用安全API的影响。我们招募44名开发者,在有无GitHub Copilot协助下完成安全API编程任务。结果表明,尽管Copilot提升了功能正确性并略微减少了部分不安全模式,但并未显著改善安全API的使用效果;仅有12%的代码实现符合安全标准。此外,开发者很少主动提出安全疑虑,许多人在使用后仍未能识别出代码中的安全隐患。研究据此提出增强安全意识的建议,并指明未来可探索的方向,以支持更安全的AI辅助开发。
原文摘要 · Abstract (English)
AI code assistants are transforming software development, but their implications for software security remain a major concern, particularly in the context of security APIs. These APIs are critical for safeguarding software systems, yet their complexity often leads to incorrect use and serious vulnerabilities. Developing an evidence-based understanding of how AI assistants influence developers' use of these APIs is therefore essential for informing effective mitigation strategies. While a few user studies have examined the broader impact of AI assistants on software vulnerabilities, the use of security APIs remains unexplored from a developer-centered perspective. This study addresses this gap by presenting the first empirical investigation into how AI code assistants affect professional developers' use of security APIs. We conducted a study with 44 developers who completed security API programming tasks with and without GitHub Copilot assistance. Our findings show that, while Copilot improves functional correctness and marginally reduces certain insecure patterns, it does not significantly improve secure API usage. We also found that developers rarely raised security concerns when engaging with Copilot, and many did not recognize that their final implementations remained insecure. Finally, we offer recommendations for enhancing security awareness among developers and propose future research directions to support safer AI-assisted software development.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。