The productivity gain is real, but so is the security risk
AI coding agents clearly boost output. In a large-scale deployment at Meta, multi-line suggestions accounted for 42% of all characters accepted by developers, even though they made up only 16% of displayed suggestions [1]. This means developers are choosing to accept longer, more complex AI-generated code blocks at a high rate. The same study found that multi-line suggestions nearly doubled the percentage of keystrokes saved—from 9% with single-line suggestions to 17% [1]. That is a tangible productivity gain.
However, a controlled user study directly compared developers with and without access to an AI assistant on security-related coding tasks. The result: participants who used the AI assistant wrote significantly less secure code [2]. Even more concerning, those same participants were more likely to believe they had written secure code, suggesting the tool breeds overconfidence [2]. This is not a lab artifact—the study used realistic tasks and a control group, making it the strongest evidence here on causality.
The human in the loop is still essential
Even the most advanced AI coding tools, like GPT-4, require substantial human validation. Experiments with GPT-4 showed that while it can generate tests with high coverage, many of those tests fail when actually run against the code [3]. This means the AI can produce code that looks correct but doesn't work properly. The same study found that GPT-4 refactoring improved code quality metrics, but only when a human verified the results [3].
This aligns with the security findings: the AI is a powerful tool, but it does not replace human judgment. The paper on data privacy and security risks in AI-based code understanding systems (like GitHub Copilot) notes that these systems can generate code snippets containing sensitive information, leading to potential unauthorized access [4]. The risk is not just that the code is buggy—it's that it may leak secrets or introduce vulnerabilities that a developer, overconfident in the AI, might miss.
The risks are easy to overlook because the benefits are immediate
The productivity gains from AI coding agents are immediate and measurable—keystrokes saved, suggestions accepted. The risks, by contrast, are delayed and harder to detect. A developer might save 17% of keystrokes today [1] but introduce a security flaw that only surfaces weeks later in a penetration test. The overconfidence effect documented in the user study [2] means developers are less likely to double-check AI-generated code, compounding the risk.
The Meta study also noted a 'jarring' effect from multi-line suggestions, where the AI constantly moves the developer's existing code around [1]. This can reduce satisfaction and productivity if not carefully managed. While less than 1% of engineers opted out of multi-line suggestions at Meta [1], that low opt-out rate may reflect the tool's usefulness—or it may reflect that the subtle costs (like increased cognitive load or hidden security flaws) are not immediately obvious to users.
About These Sources
This answer is built on 4 studies (3 peer-reviewed, 1 preprint) — published from 2023 to 2024, 2 from 2024 or later, collectively cited 180 times — selected as the most relevant from 4 studies that passed quality screening, drawn from 63 papers retrieved from a database of over 500 million.
Sources used in this answer
Multi-line AI-Assisted Code Authoring
In a large-scale deployment at Meta, multi-line AI suggestions accounted for 42% of accepted characters despite being only 16% of displayed suggestions, and nearly doubled keystroke savings from 9% to 17%, though they introduced a 'jarring' effect that required careful UX design.
Do Users Write More Insecure Code with AI Assistants?
In a controlled user study, participants with access to an AI assistant wrote significantly less secure code than those without, and were more likely to believe their code was secure, indicating overconfidence.
AI-assisted coding: Experiments with GPT-4
Experiments with GPT-4 showed that while it can generate tests with high coverage, many tests fail when run against the code, and substantial human validation is required to ensure accuracy.
Data Privacy and Security Risks in AI-Based Code Understanding
A literature review of AI-based code understanding systems (e.g., GitHub Copilot) found that they can generate code snippets containing sensitive information, leading to risks of unauthorized access and misuse.