  Modern code generation tools use AI models, particularly Large Language
Models (LLMs), to generate functional and complete code. While such tools are
becoming popular and widely available for developers, using these tools is
often accompanied by security challenges. Therefore, it is important to assess
the quality of the generated code, especially in terms of its security.
Researchers have recently explored various aspects of code generation tools,
including security. However, many open questions about the security of the
generated code require further investigation, especially the security issues of
automatically generated code in the wild. To this end, we conducted an
empirical study by analyzing the security weaknesses in code snippets generated
by GitHub Copilot that are found as part of publicly available projects hosted
on GitHub. The goal is to investigate the types of security issues and their
scale in real-world scenarios (rather than crafted scenarios). To this end, we
identified 435 code snippets generated by Copilot from publicly available
projects. We then conducted extensive security analysis to identify Common
Weakness Enumeration (CWE) instances in these code snippets. The results show
that (1) 35.8% of Copilot generated code snippets contain CWEs, and those
issues are spread across multiple languages, (2) the security weaknesses are
diverse and related to 42 different CWEs, in which CWE-78: OS Command
Injection, CWE-330: Use of Insufficiently Random Values, and CWE-703: Improper
Check or Handling of Exceptional Conditions occurred the most frequently, and
(3) among the 42 CWEs identified, 11 of those belong to the currently
recognized 2022 CWE Top-25. Our findings confirm that developers should be
careful when adding code generated by Copilot (and similar AI code generation
tools) and should also run appropriate security checks as they accept the
suggested code.
