How to Use AI Coding Assistants, and the Risks: Security and Licences

What a coding assistant takes off your plate

A coding assistant quickly fills in the code developers write over and over, explains what an unfamiliar error message means, and walks through someone else's code line by line. It saves a lot of time drafting tests, writing hard-to-remember syntax such as regular expressions, and tidying up comments and documentation. It is also good for asking how a concept from one language carries over to a language you are just learning. But responsibility for the code it writes stays with the person who merges it. As things get easier, the habit of reviewing has to grow with them.

Code that runs is not the same as code that is right

AI-generated code usually looks plausible and often runs. The problem is that running is no guarantee it does exactly what was required. It may skip edge cases such as empty input or very large values, quietly swallow errors, or use an approach that only worked in older versions. It can also confidently invent function or setting names that do not exist. So when you get code, check in the official documentation that the functions and settings really exist, and run it yourself on the versions in your own environment.

Security: what to watch most closely

The most dangerous code is code that works well but is not safe. Because nothing looks wrong on the surface, it slips through review easily. Set aside time to look at areas like these.

• User input passed straight into database queries or commands without checks
• Passwords or access keys written directly into the code
• Old encryption or hashing methods already known to be weak
• File or network permissions wider than needed
• Suggestions to install an external package you have never heard of

Beware of invented package names

AI sometimes invents a plausible-sounding external package and tells you to install it. If the name does not exist, the install simply fails. But if someone has registered that name in advance and put harmful code in it, your computer and servers are at risk the moment you install it. When you are told to add a new package, confirm in the official registry that it exists, that it is actively maintained and that the spelling is exact before installing. In a team, a rule that new dependencies need someone else's review helps.

Keep secrets out

In a hurry to fix an error, people often paste in a whole config file or log, and those easily contain access keys, passwords or customer data. How what you type is stored and used varies by service and plan, so check the terms and settings. For company code, internal policy on outside tools comes first. Before pasting, swap secret values for dummy ones and cut the code down to the minimum needed to reproduce the problem. If you paste a key by mistake, the safe move is to revoke it at once and issue a new one.

Licences and copyright

Public code comes with terms of use. Some require you to keep attribution and copyright notices, and some require that work built on the code be released under the same terms. You cannot completely rule out AI-generated code coming out nearly identical to existing public code. If you receive a long, distinctive block of code, search for similar public code, and follow your company's licence policy before putting it into a product. Rights in AI output are treated differently by country and by each service's terms, so check the official guidance.

How to review it

Treat the assistant's output as a change sent by a colleague and review it to the same standard.

• If there is even one line you do not understand, get it explained and be satisfied before merging
• Write tests for normal and edge-case input and actually run them
• Confirm that any newly added dependency is real and maintained
• Look separately at error handling and the scope of permissions

If you are learning

If you are still learning to program, writing it yourself first and then comparing with the assistant's code does more for your skills than taking the answer straight away. When you are stuck, you can ask for a hint or an approach instead of finished code. Without the basics, you will not notice when the assistant gives you wrong code, and you lose the ability to do the most important job of all, which is reviewing. Check your course's policy on whether AI is allowed for assignments or exams.