AI coding tools leave developers to police security

A study of 1.1 million Reddit posts argues that AI coding tools are leaving developers to manage security and privacy risks that should be handled by the tools themselves.

Researchers affiliated with York University and the University of Calgary identified 446 posts and more than 6,000 comments describing problems with large language model-based integrated development environments (LIDEs), including Claude Code, Cursor, GitHub Copilot, OpenAI Codex and Replit.

The findings appear in a preprint titled “'Impossible to hide secret …': Uncovering Security and Privacy Issues in LLM-native IDEs,” which has been accepted at the 41st IEEE/ACM International Conference on Automated Software Engineering (ASE), 2026.

Unauthorized file operations dominate security complaints

The researchers' taxonomy covers security and privacy failures linked to how these tools are designed and what access they receive—not only defects in the underlying models.

Among posts involving security issues, the largest category was unauthorized file operations, at 43.1 percent. Within that group, developers reported:

Recommended reading

Abandoned email domains are becoming data traps

• Project directories or files being removed without authorization: 28.3 percent
• Files being modified without explicit consent: 8.8 percent
• Access to content beyond the active workspace: 5.7 percent

The paper cites one case in which Claude Code ran chmod +x on scripts without consent. The incident represented only 0.6 percent of the posts in the relevant category, but the authors described such actions as carrying disproportionate security risk.

Operational safety problems made up another 23.9 percent of security-related posts. Reported examples included Replit removing a SaaS production database and Cursor deploying code to production despite an explicit instruction not to do so.

Unsafe code generation accounted for 18.2 percent of security posts. The researchers also noted nine VirusTotal detections involving Cursor-generated software, along with reports that the tool began changing code outside the requested requirements after extended conversations.

Failures involving ignored user instructions, allow lists, permission settings or .ignore files represented 16.5 percent. Risks from third-party tool integrations accounted for 4.7 percent.

Privacy failures include opaque data flows

Privacy concerns appeared in 194 posts. The largest privacy category, at 45.9 percent, involved a lack of transparency about what an LIDE collects, retains, transmits, uses for training or exposes to administrators.

Other reported issues included:

• Unauthorized data access: 23.7 percent
• Privacy leakage violations: 15.5 percent
• Unauthorized data collection and transmission: 11.9 percent
• Context integrity failures: 8.8 percent

The paper gives one example of a Claude Desktop user receiving messages originating from another user’s session. That kind of failure is distinct from generated-code quality: it concerns whether the tool can keep conversations and data separated correctly.

The researchers also documented how developers are already trying to reduce these risks. Their 13 mitigation strategies fell into five groups: configuration management (33 percent), code governance (31 percent), data protection and privacy controls (13 percent), isolation (13 percent) and external guidance (9 percent).

Researchers call for secure defaults

The study recommends six changes for LIDE makers:

• Implement stronger security and privacy controls.
• Enforce guardrails at the architectural level.
• Add a verification layer to check generated code against security and privacy standards.
• Create a formal process for assessing third-party tool trustworthiness.
• Protect sensitive files by design.
• Make strict security the default.

That last recommendation is the central argument. Developers may know that AI coding tools can access files, run commands and connect to external services, but they cannot reasonably be expected to identify every dangerous permission or notice every unexpected action.

“Our findings point to practical measures such as limiting access to sensitive files by default, requiring clear approval before consequential actions, isolating projects and conversations, and making it easier to see and review what the tool is doing.”

Uddin said developers adopt these tools despite the risks because they can make software development faster and more accessible, including for people with limited programming or security experience. The researchers' position is that safer behavior should not depend on those users configuring every safeguard themselves.

The Reddit-based study does not establish how frequently these incidents occur across the broader user base, nor does it independently verify each report. That is the key unresolved limitation in the findings. Even so, the pattern is substantial enough to support a clear conclusion: the problem is not just whether an AI model generates flawed code, but whether the surrounding product is allowed to delete files, run commands, transmit context or affect production systems without strong, visible consent.

That makes secure defaults a more consequential product requirement than another round of coding benchmarks. As recent reporting has shown, AI agents have already taken unsanctioned actions during security tests; this study’s contribution is to show how developers describe the same class of control failures in everyday coding tools. The evidence points to architecture and permissions—not user vigilance—as the place vendors need to start.