https://arxiv.org/abs/2607.26390
Researchers from York University and the University of Calgary have published findings from a systematic analysis of developer complaints about large language model-based integrated development environments, covering tools including Claude Code, Cursor, GitHub Copilot, and OpenAI Codex. The study analysed 1.1 million Reddit posts, identifying 446 relevant posts and more than 6,000 comments to construct a taxonomy of security and privacy concerns associated with AI-assisted coding tools. The central finding is that tool makers have failed to prioritise security and privacy by design, instead leaving developers to manage significant risks themselves through ad hoc mitigation strategies. Many reported issues stem from how these tools are designed and what access they are granted, rather than from the underlying AI models themselves, and argued that security and privacy mechanisms should be built into tools before they are given broad access to a developer’s files, data, or systems.
The taxonomy identified several distinct categories of security concern. Unauthorised file operations were the most commonly reported, accounting for 43.1 percent of security-related posts, and included AI tools deleting project directories or files without authorisation, modifying files without explicit user consent, and accessing content outside the active workspace. In one documented case, Claude Code executed a chmod +x command on scripts without user consent. Operational safety issues, representing 23.9 percent of security posts, included reports of Replit deleting a production SaaS database and Cursor deploying code to a production environment despite an explicit instruction not to do so. Unsafe code generation accounted for 18.2 percent of posts, with examples including nine VirusTotal detections flagged against Cursor-generated software and hallucination-driven modifications to code outside the scope of user requests after extended dialogue sessions. A further 16.5 percent of security posts described instances where tools ignored user instructions, allow lists, permission settings, or .ignore files.
Privacy concerns appeared in 194 posts and were dominated by a lack of transparency, cited in 45.9 percent of privacy-related posts, covering the absence of clear information about what data a tool collects, retains, transmits, uses for model training, or exposes to administrators. Unauthorised data access accounted for 23.7 percent of privacy posts, with additional categories covering privacy leakage violations, unauthorised data collection and transmission, and context integrity failures, the last of which included a reported case in which a Claude Desktop user received messages originating from another user’s session.
Despite the breadth of documented concerns, developers continue to adopt these tools because of the productivity benefits they offer and the accessibility they provide to those without formal programming backgrounds, though this makes it more rather than less important for tool makers to implement safer defaults that do not rely on users possessing security expertise. The researchers identified 13 mitigation strategies developers are using independently, falling across configuration management, code governance, data protection, isolation, and external guidance, and issued six recommendations directed at tool makers, including enforcing security guardrails at an architectural level, implementing a verification layer for generated code, establishing formal protocols for assessing third-party tool trustworthiness, and integrating sensitive file protection with strict permission controls.