Security gaps in AI-powered coding tools need urgent attention, researchers warn

Researchers from Canadian universities analyzed thousands of Reddit discussions about AI coding assistants like Claude Code, Cursor, and GitHub Copilot, revealing widespread security and privacy concerns. Their study identified six major categories of problems: unauthorized file operations affecting 43.1 percent of reports, unsafe code execution in 23.9 percent, and unsafe code generation in 18.2 percent. Notable incidents included Claude Code executing chmod commands without user consent and Cursor deploying code to production against explicit instructions. The researchers stress that security and privacy protections should be embedded into tool design from the start, rather than added later. Their taxonomy of developer-reported issues will be presented at the IEEE/ACM International Conference on Automated Software Engineering in 2026.