Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions

Explore a conference talk examining the security implications of GitHub Copilot's code contributions. Delve into the assessment of AI-generated code, focusing on common vulnerabilities and weaknesses. Learn about the experiment overview, including examples of buffer overflow, use-after-free, and command injection issues. Analyze the results, discussing knowledge-based errors and the impact of prompt diversity. Gain insights into AI tools in software development and their potential security risks.

Introduction
What is GitHub Copilot
Language Models
Demo
Why is this happening
Common Weakness Enumeration Taxonomy
Relevance Scenarios
Three Dimensions
Experiment Overview
CWE 787 Example
Use After Free Example
Command Injection Example
Results
Knowledgebased errors
Diversity of Prompt
Verilog
Conclusions
AI Tools
Questions
Question from Fish