← Back to Research Radar
Academic Publication Academic Publication

Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions

147
Citations
February 1, 2025
Published Date

Research Abstract & Technology Focus

There is burgeoning interest in designing AI-based systems to assist humans in designing computing systems, including tools that automatically generate computer code. The most notable of these comes in the form of the first self-described “AI pair programmer,” GitHub Copilot, which is a language model trained over open-source GitHub code. However, code often contains bugs—and so, given the vast quantity of unvetted code that Copilot has processed, it is certain that the language model will have learned from exploitable, buggy code. This raises concerns on the security of Copilot’s code contributions. In this work, we systematically investigate the prevalence and conditions that can cause GitHub Copilot to recommend insecure code. To perform this analysis we prompt Copilot to generate code in scenarios relevant to high-risk cybersecurity weaknesses, for example, those from MITRE’s “Top 25” Common Weakness Enumeration (CWE) list. We explore Copilot’s performance on three distinct code generation axes—examining how it performs given diversity of weaknesses, diversity of prompts, and diversity of domains. In total, we produce 89 different scenarios for Copilot to complete, producing 1,689 programs. Of these, we found approximately 40% to be vulnerable.
asleep keyboard assessing security github copilot
Read Full Literature

AI Semantic Synergy Context

Connecting this academic literature to real-world market discussions and products.

crossref.org › academic paper
100%
🔥

Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions

There is burgeoning interest in designing AI-based systems to assist humans in designing computing systems, including tools that automatically generate computer code. The most notable of these come...
github.com › AI insight
0%

Address Snyk and Socket security audit findings in skill docs

Security audits by Snyk and Socket identified critical vulnerabilities in the 'codebase-to-course' skill, including risky credential handling, third-party content exposure from arbitrary repo intak...
roipad.com › trend story
0%

GitHub Copilot unlocks OpenAI's GPT-5.4 in VSCode and other coding platforms — Adding even more vibe coding options

GitHub Copilot has added support for OpenAI’s GPT-5.4 coding model, bringing improved reasoning and support for multi-step tasks. The model is available across several development environments.
roipad.com › trend story
0%

Give GitHub Copilot CLI real code intelligence with language servers

Install and configure LSP servers for GitHub Copilot CLI, replacing brute-force grep/decompile with real code intelligence. The post Give GitHub Copilot CLI real code intelligence with language se...
stackexchange.com › answer
0%

How do I automatically approve "low risk" Github Copilot commands in VS Code?

Yes. In recent versions of VS Code, the closest built-in option is Assisted permissions. You can enable it with: "chat.assistedPermissions.enabled": true Then select Assisted permissions from the ...

Frequently Asked Questions (FAQ)

Curated market intelligence mapped to this research.

What is the core focus of the research titled 'Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions'?

This literature focuses on: There is burgeoning interest in designing AI-based systems to assist humans in designing computing systems, including tools that automatically generate computer code. The most notable of these comes in the form of the first self-described “AI pair...

Are there open-source GitHub repositories related to Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions?

Yes, open-source projects like Keychron/Keychron-Keyboards-Hardware-Design (Industrial design files for Keychron keyboards and mice. 100+ models with CAD assets in STEP, DXF, DWG, and PDF. Source-available, with commercial ...) are actively building upon these concepts.

Which startups are commercializing the technology behind Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions?

Products like Keeby are bringing this to market. Their focus is: Mechanical keyboard sounds for your Mac.

What other academic literature is closely related to 'Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions'?

Yes, highly correlated activity was mapped. An entry titled 'Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions' discusses this: There is burgeoning interest in designing AI-based systems to assist humans in designing computing systems, including tools that automatically gene...

Are there commercial applications of 'Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions' in market news publications?

Yes, highly correlated activity was mapped. An entry titled 'GitHub Copilot unlocks OpenAI's GPT-5.4 in VSCode and other coding platforms — Adding even more vibe coding options' discusses this: GitHub Copilot has added support for OpenAI’s GPT-5.4 coding model, bringing improved reasoning and support for multi-step tasks. The model is avai...

Cite this Market Intelligence Report

Reference our AI-mapped synergy between this research and the commercial market to instantly build authority.

Commercial Realization

Startups and Open Source tools heavily associated with the concepts explored in this paper.

Associated Media Narrative