ai-research-survey

scan.json (27884B)

---

 {
   "paper": {
     "title": "AI Code in the Wild: Measuring Security Risks and Ecosystem Shifts of AI-Generated Code in Modern Software",
     "authors": [
       "Bin Wang",
       "Wenjie Yu",
       "Yilu Zhong",
       "Hao Yu",
       "Keke Lian",
       "Chaohua Lu",
       "Hongfang Zheng",
       "Dong Zhang",
       "Hui Li"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2512.18567"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The abstract states 'We will open-source the complete dataset and release analysis artifacts' and Section 3 says 'We will open-source the corresponding detection model and dataset.' Both are promises of future release, not actual releases. No repository URL or archive link is provided."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "Same as above — the dataset and analysis artifacts are promised for future release but no download link or repository URL is provided in the paper."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications, requirements files, Dockerfiles, or library version listings are provided anywhere in the paper."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The methodology is described at a high level in Sections 3-4 but without specific commands, scripts, or a reproduction guide."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Results are reported as point estimates throughout (e.g., accuracy 0.718, precision 0.716). No confidence intervals, error bars, or uncertainty quantification is provided for any of the main results."
       },
       "significance_tests": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.3 uses the Mann-Whitney U test to compare severity score distributions between AI-introduced and human-introduced vulnerabilities (p=0.091, alpha=0.05). The null and alternative hypotheses are explicitly stated."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "While the paper reports percentage differences (e.g., AI net impact scores like +7.6% for C#, +4.9% for PHP), no formal effect size measures (Cohen's d, odds ratios, etc.) are reported. The Mann-Whitney U test in Section 6.3 reports only p-values, not effect sizes."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No justification is given for why the top 1,000 GitHub repositories were chosen as the sample size, nor is there any power analysis. The choice of 7,000+ CVEs is also not justified beyond availability."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Detection framework results (accuracy, precision, recall, F1) are reported as single-run point estimates. No standard deviations, confidence intervals across runs, or variance measures are provided for the CAF evaluation or the ecosystem analysis."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 evaluates seven baseline AI-generated text detection models, and Section 3.3.1 compares CAF against these baselines (Fig. 3b)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The baseline models include recent detection tools from ICLR 2024 and contemporary Hugging Face models, representing current state-of-the-art in AIGC detection."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.3.1 presents an ablation study comparing the full CAF model with variants: 'w/o Stage 1' (removing cascaded preprocessing) and 'w/o Stage 2' (removing weighted aggregation), shown in Fig. 3c."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The detection framework is evaluated using four metrics: Accuracy, Precision, Recall, and F1-score (Section 3.2). The security analysis uses CVSS scores, attack vector distributions, CWE type distributions, and AI net impact scores."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation of the detection pipeline's outputs is reported. The accuracy of the AIGCode detector — which is the foundation of all downstream ecosystem and security claims — is evaluated only against automated labels, with no human verification of a sample of the detector's classifications on real-world commits."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 states '30% of the samples from the evaluation dataset' were used for testing baselines, and Section 3.3.1 evaluates CAF 'on the held-out 70% of the evaluation set.' The split is explicit."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Extensive per-category breakdowns are provided: by programming language (Fig. 4a), by tech stack over time (Fig. 4b), by file function category (Fig. 4c), by CWE type (Fig. 5b), and by language for vulnerability lifecycle roles (Fig. 5a)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 9 (Limitations) discusses detection accuracy limitations, acknowledging the detector 'leaves room for improvement — for example, in more finely identifying AI-originated code that has been heavily edited by humans.' The ablation study also discusses failure modes (e.g., removing Stage 2 causes 'catastrophic failure')."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.2 reports that existing AIGC text detection models 'face significant performance challenges' when transferred to code detection. Section 3.3.1 reports ablation variants that fail dramatically (w/o Stage 2 has F1=0.012). Section 6 reports that AI's net impact on security is negative across all languages."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract's three 'ecological patterns' — (1) AI concentrates in boilerplate/tests/docs, (2) some CWE families overrepresented in AI code, (3) AI introduces high-throughput changes while humans act as gatekeepers — are all supported by specific results in Sections 5-7 with figures and statistics."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes causal claims such as 'AI-induced vulnerabilities propagated by shared models rather than shared maintainers' (abstract) and 'when review is shallow, AI-introduced defects persist longer.' These causal interpretations are drawn from observational/correlational data (classifier-based labeling of commits) without adequate causal identification strategies. The study cannot distinguish whether AI caused the vulnerabilities or whether the AI detector is correlated with certain code patterns that are independently vulnerable."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title says 'Modern Software' but the study only covers the top 1,000 GitHub repositories by stars, which is a highly non-representative sample (skewed toward popular open-source projects). Findings are presented as general statements about 'AIGCode in the wild' without adequately bounding the generalization to this specific sample. The abstract calls it 'the first large-scale empirical study of AI-generated code in the wild' but the 'wild' is limited to top-starred GitHub repos."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not substantively discuss alternative explanations for its findings. For example, the correlation between AI-detected code and vulnerability patterns could be driven by detector bias (the detector may systematically misclassify certain code styles). The Section 9 limitations mention detector accuracy but do not discuss how detection errors might systematically bias the security findings."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The AI-generated code subset was created using 11 LLMs listed in Fig. 1a (e.g., 'gpt-4o', 'claude-sonnet-4-20250514', 'gpt-3.5-turbo', 'Qwen2.5-Coder-Instruct', 'gemini-2.5-flash'). While 'claude-sonnet-4-20250514' includes a date, most others like 'gpt-4o', 'gpt-3.5-turbo', and 'grok-3' lack version specifiers or snapshot dates. The baseline detection models are referred to only by pseudonyms (HCR, SRL, ORD, DAD, Y-Zh2, Y-En2, Y-En3) with no real model names or versions."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "Section 3.1 describes 33 programming topics refined into 165 specific tasks used to generate AI code, but the actual prompts used for code generation are not provided. The prompts or instructions given to the LLM-based judgment mechanism for CWE scanning are also not provided."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Key hyperparameters for the detection framework are reported: Stage 1 confidence threshold tau_1 = 0.9, Stage 2 decision threshold tau_2 = 0.53, and the master referee weight of 2 vs auxiliary weight of 1 (Section 3.3)."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not use agentic scaffolding. The detection framework is an ensemble of classifiers, not an agentic system."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.1 documents the data construction pipeline: time window for human code (2008-2010), filtering non-code files by extension, serialization. Section 4 describes the GitHub data collection (top 1000 repos by stars, 2022-2025 window, file-level granularity). The vulnerability dataset pipeline is described in Section 4 (CVE metadata retrieval, GitHub search, manual verification)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 9 is titled 'Limitations and Future Work' and contains substantive discussion of the study's limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 9 discusses specific threats: (1) the 2022-2025 time window may miss earlier AI tools, (2) the detector accuracy is not perfect and 'leaves room for improvement — for example, in more finely identifying AI-originated code that has been heavily edited by humans,' and (3) they 'deliberately do not perform extensive modeling, tuning, or error analysis of the detector itself.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "While Section 9 mentions the time window limitation and detector accuracy, the paper does not explicitly state what the results do NOT show. It does not bound the findings to top-starred GitHub repos or discuss that findings may not apply to private/enterprise codebases, smaller projects, or non-English-dominant projects."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The raw data (commit-level classifications, CVE-linked code samples, detection pipeline outputs) is not available. The paper promises future release but provides no current access."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Sections 3.1 and 4 describe the data collection in detail: the human code subset from pre-2010 commits on high-starred repos, AI code generated from 11 LLMs across 165 tasks, GitHub top 1000 repos by stars for 2022-2025, and CVE-linked code from public intelligence sources with manual verification."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. The data sources are public repositories and CVE databases, which are standard public data sources."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full pipeline is documented: Section 3.1 describes dataset construction from collection to labeling; Section 3.3 describes the detection framework stages; Section 4 describes the in-the-wild data collection from GitHub commits and CVE sources. Sample counts are provided (40K human, 40K AI for evaluation set; top 1000 repos; 7000+ CVEs)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the paper. No grants or sponsors are mentioned."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Peking University and Tencent. The paper header lists each author's affiliation."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Several authors are affiliated with Tencent, a major technology company that develops and uses AI code generation tools. The paper does not disclose whether Tencent funded this research, nor does it discuss whether Tencent has a financial interest in the findings about AI-generated code security."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper. Given that Tencent-affiliated authors are involved, the absence of any conflict disclosure is a gap."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not evaluate a pre-trained model's capability on a benchmark. The detection framework is an ensemble of existing classifiers applied to code provenance detection, not a benchmark evaluation of LLM knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the paper does not evaluate a pre-trained model's capability on a benchmark. The detection task is classification of human vs. AI code, not model knowledge evaluation."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Not applicable for the same reasons. The paper's contribution is an empirical study of AI code prevalence and security, not a benchmark evaluation of LLM capabilities."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. The study analyzes code repositories and CVE data."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not report the cost of running the detection pipeline across the top 1,000 GitHub repositories, nor the cost of generating the AI code evaluation dataset using 11 commercial and open-source LLMs."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No computational budget is stated — no mention of GPU hours, API costs, total processing time, or hardware used for the detection pipeline or data generation."
       }
     }
   },
   "claims": [
     {
       "claim": "AIGCode is already a substantial fraction of new code in top GitHub repositories, with AI file rates ranging from 25.42% (Java) to 45.43% (TypeScript).",
       "evidence": "Section 5.1 and Fig. 4a present per-language AI file rates computed from the top 1000 GitHub repos (2022-2025).",
       "supported": "moderate"
     },
     {
       "claim": "The Cascade-Aggregation Framework achieves best overall performance with Accuracy 0.718, Precision 0.716, and F1 0.719 for AI code detection.",
       "evidence": "Section 3.3.1 and Fig. 3b compare CAF against seven baselines on the held-out 70% evaluation set.",
       "supported": "moderate"
     },
     {
       "claim": "AI's net impact on security is negative across all analyzed languages — AI introduces more vulnerabilities than it fixes.",
       "evidence": "Section 6.1 and Fig. 5a show positive AI net impact scores (introduction rate minus fix rate) for all 10 languages analyzed.",
       "supported": "weak"
     },
     {
       "claim": "There is no statistically significant difference in severity between AI-introduced and human-introduced vulnerabilities (Mann-Whitney U test, p=0.091).",
       "evidence": "Section 6.3 reports the Mann-Whitney U test result with median AI severity 7.00 vs human 7.10.",
       "supported": "strong"
     },
     {
       "claim": "AI-introduced vulnerabilities are more concentrated in network attack vectors (86.8%) compared to human-introduced vulnerabilities (80.8%).",
       "evidence": "Section 6.3 and Fig. 5d report attack vector distributions.",
       "supported": "moderate"
     },
     {
       "claim": "CWE-1236 and CWE-916 are the most overrepresented vulnerability types in AI-generated code, with AI file rates of 50.7% and 43.1% respectively.",
       "evidence": "Section 6.2 and Fig. 5b present the CWE type distribution analysis.",
       "supported": "moderate"
     },
     {
       "claim": "Existing AIGC text detectors suffer from precision-recall imbalance when transferred to code detection tasks.",
       "evidence": "Section 3.2 and Fig. 3a show that seven baseline models have highly imbalanced precision/recall on the evaluation dataset.",
       "supported": "strong"
     }
   ],
   "methodology_tags": [
     "observational",
     "benchmark-eval"
   ],
   "key_findings": "This paper presents the first large-scale empirical study of AI-generated code prevalence and security impact across the top 1,000 GitHub repositories (2022-2025) and 7,000+ CVE-linked code changes. Key findings include: AI-generated code concentrates in documentation, tests, and boilerplate rather than core logic and config files; certain CWE families (particularly input validation and cryptographic issues) are overrepresented in AI-tagged code; and AI introduces more vulnerabilities than it fixes across all analyzed languages, though the severity is comparable to human-introduced vulnerabilities. The paper also proposes a Cascade-Aggregation Framework for AI code detection that achieves F1=0.719.",
   "red_flags": [
     {
       "flag": "All findings depend on imperfect detector with only 71.8% accuracy",
       "detail": "The entire study's ecosystem and security findings rely on the CAF detector, which has only 71.8% accuracy and 71.6% precision. Roughly 28% of classifications may be wrong, and systematic biases in the detector could propagate into all downstream results (e.g., the security risk profile, language adoption rates). The paper acknowledges this in Section 9 but does not quantify how detection errors affect the security conclusions."
     },
     {
       "flag": "No human validation of detector on in-the-wild data",
       "detail": "The detector is evaluated on a synthetic evaluation dataset where AI code is generated from prompts (Section 3.1) and human code is from pre-2010. In-the-wild code from 2022-2025 may have very different characteristics (e.g., human code influenced by AI suggestions, hybrid human-AI editing). No human expert validates the detector's classifications on actual GitHub commits."
     },
     {
       "flag": "Causal claims from correlational data",
       "detail": "The paper states AI-generated code 'introduces' vulnerabilities and describes 'AI-induced vulnerabilities propagated by shared models.' These are causal claims drawn from an observational study where code is labeled by an imperfect classifier. The detector may be confounding code style with code provenance."
     },
     {
       "flag": "Potential industry conflict not disclosed",
       "detail": "Four authors are affiliated with Tencent, a major tech company that both develops and uses AI code generation tools. No funding source or competing interests statement is provided."
     },
     {
       "flag": "No variance or uncertainty reporting for any results",
       "detail": "All detection framework metrics and ecosystem statistics are reported as point estimates without error bars, confidence intervals, or variance across multiple runs. Given the 71.8% accuracy, uncertainty quantification is especially important."
     },
     {
       "flag": "Evaluation dataset has temporal confound",
       "detail": "The human code subset comes from 2008-2010 commits while AI code is generated from recent LLMs. The detector may be learning temporal coding style differences (modern vs. older idioms) rather than genuine human/AI differences. When applied to 2022-2025 code, this confound could cause systematic misclassification."
     }
   ],
   "cited_papers": [
     {
       "title": "The impact of ai on developer productivity: Evidence from github copilot",
       "authors": ["Sida Peng", "Eirini Kalliamvakou", "Peter Cihon", "Mert Demirer"],
       "year": 2023,
       "arxiv_id": "2302.06590",
       "relevance": "RCT measuring GitHub Copilot's effect on developer productivity, directly relevant to the survey's core question of AI coding tool impact."
     },
     {
       "title": "Do users write more insecure code with ai assistants?",
       "authors": ["Neil Perry", "Megha Srivastava", "Deepak Kumar", "Dan Boneh"],
       "year": 2023,
       "relevance": "User study examining whether AI assistants lead to more insecure code, directly relevant to the security dimension of AI-generated code."
     },
     {
       "title": "Security weaknesses of copilot-generated code in github projects: An empirical study",
       "authors": ["Yujia Fu", "Peng Liang", "Amjed Tahir", "Zengyang Li", "Mojtaba Shahin", "Jiaxin Yu", "Jinfu Chen"],
       "year": 2025,
       "relevance": "Empirical study of security weaknesses in Copilot-generated code found in GitHub projects, directly related to AIGCode security."
     },
     {
       "title": "Evaluating large language models trained on code",
       "authors": ["Mark Chen"],
       "year": 2021,
       "arxiv_id": "2107.03374",
       "relevance": "Foundational paper introducing HumanEval and Codex, establishing code generation benchmarks relevant to the survey."
     },
     {
       "title": "Vulnerabilities in ai code generators: Exploring targeted data poisoning attacks",
       "authors": ["Domenico Cotroneo", "Cristina Improta", "Pietro Liguori", "Roberto Natella"],
       "year": 2024,
       "relevance": "Studies targeted data poisoning attacks against AI code generators, relevant to understanding security risks of AI-generated code."
     },
     {
       "title": "Security implications of large language model code assistants: A user study",
       "authors": ["Gustavo Sandoval", "Hammond Pearce", "Teo Nys", "Ramesh Karri", "Brendan Dolan-Gavitt", "Siddharth Garg"],
       "year": 2022,
       "arxiv_id": "2208.09727",
       "relevance": "User study on security implications of LLM code assistants, measuring whether AI assistance affects code security in practice."
     },
     {
       "title": "The impact of generative AI on collaborative open-source software development: Evidence from GitHub Copilot",
       "authors": ["Fangchen Song", "Ashish Agarwal", "Wen Wen"],
       "year": 2024,
       "arxiv_id": "2410.02091",
       "relevance": "Measures impact of generative AI on open-source software development, relevant to understanding AI code adoption."
     },
     {
       "title": "Codexity: secure AI-assisted code generation",
       "authors": ["Sung Yong Kim", "Zhiyu Fan", "Yannic Noller", "Abhik Roychoudhury"],
       "year": 2024,
       "arxiv_id": "2405.03927",
       "relevance": "Proposes methods for secure AI-assisted code generation, directly relevant to mitigating security risks of AI-generated code."
     },
     {
       "title": "SecurityEval dataset: mining vulnerability examples to evaluate machine learning-based code generation techniques",
       "authors": ["Mohammed Latif Siddiq", "Joanna CS Santos"],
       "year": 2022,
       "relevance": "Provides a benchmark dataset for evaluating code generation security, relevant to methodology of evaluating AI code quality."
     },
     {
       "title": "CodeLMSec benchmark: Systematically evaluating and finding security vulnerabilities in black-box code language models",
       "authors": ["Hossein Hajipour", "Keno Hassler", "Thorsten Holz", "Lea Schönherr", "Mario Fritz"],
       "year": 2024,
       "relevance": "Systematic benchmark for evaluating security vulnerabilities in code language models, relevant to AI code security evaluation."
     },
     {
       "title": "Security Degradation in Iterative AI Code Generation–A Systematic Analysis of the Paradox",
       "authors": ["Shivani Shukla", "Himanshu Joshi", "Romilla Syed"],
       "year": 2025,
       "arxiv_id": "2506.11022",
       "relevance": "Analyzes how iterative AI code generation may degrade security over time, directly relevant to the security risk profile of AIGCode."
     },
     {
       "title": "Automatic programming: Large language models and beyond",
       "authors": ["Michael R Lyu", "Baishakhi Ray", "Abhik Roychoudhury", "Shin Hwei Tan", "Patanamon Thongtanunam"],
       "year": 2025,
       "relevance": "Survey of automatic programming with LLMs, providing broader context for AI-assisted code generation research."
     }
   ]
 }