There is burgeoning interest in designing AI-based systems to assist humans in designing computing systems, including tools that automatically generate computer code. The most notable of these comes in the form of the first self-described ‘AI pair programmer’, GitHub Copilot, a language model trained over open-source GitHub code. However, code often contains bugs—and so, given the vast quantity of unvetted code that Copilot has processed, it is certain that the language model will have learned from exploitable, buggy code. This raises concerns on the security of Copilot’s code contributions. In this work, we systematically investigate the prevalence and conditions that can cause GitHub Copilot to recommend insecure code. To perform this analysis we prompt Copilot to generate code in scenarios relevant to high-risk CWEs (e.g. those from MITRE’s “Top 25” list). We explore Copilot’s performance on three distinct code generation axes—examining how it performs given diversity of weaknesses, diversity of prompts, and diversity of domains. In total, we produce 89 different scenarios for Copilot to complete, producing 1,692 programs. Of these, we found approximately 40% to be vulnerable.

We introduce Codex, a GPT language model fine-tuned on publicly available code from GitHub, and study its Python code-writing capabilities. A distinct production version of Codex powers GitHub Copilot. On HumanEval, a new evaluation set we release to measure functional correctness for synthesizing programs from docstrings, our model solves 28.8% of the problems, while GPT-3 solves 0% and GPT-J solves 11.4%. Furthermore, we find that repeated sampling from the model is a surprisingly effective strategy for producing working solutions to difficult prompts. Using this method, we solve 70.2% of our problems with 100 samples per problem. Careful investigation of our model reveals its limitations, including difficulty with docstrings describing long chains of operations and with binding operations to variables. Finally, we discuss the potential broader impacts of deploying powerful code generation technologies, covering safety, security, and economics.

I limited the investigation to Python suggestions with a cutoff on May 7, 2021 (the day we started extracting that data). That left 453,780 suggestions spread out over 396 “user weeks”, i.e. calendar weeks during which a user actively used GitHub Copilot on Python code.

…For most of GitHub Copilot’s suggestions, our automatic filter didn’t find any substantial overlap with the code used for training. But it did bring 473 cases to our attention. Removing the first bucket (cases that look very similar to other cases) left me with 185 suggestions. Of these, 144 got sorted out in buckets 2—4. This left 41 cases in the last bucket, the “recitations”, in the meaning of the term I have in mind.

That corresponds to 1 recitation event every 10 user weeks (95% confidence interval: 7—13 weeks, using a Poisson test).

…This investigation demonstrates that GitHub Copilot can quote a body of code verbatim, but that it rarely does so, and when it does, it mostly quotes code that everybody quotes, and mostly at the beginning of a file, as if to break the ice.

…The answer is obvious: sharing the pre-filtering solution we used in this analysis to detect overlap with the training set. When a suggestion contains snippets copied from the training set, the UI should simply tell you where it’s quoted from. You can then either include proper attribution or decide against using that code altogether. This duplication search is not yet integrated into the technical preview, but we plan to do so. And we will both continue to work on decreasing rates of recitation, and on making its detection more precise.

[If you find ‘1 possible copy every 10 man-weeks’ concerning, you’d better not look too hard at the overlap of your own codebase with StackExchange/​​​GitHub or the licensing requirements (especially attribution) of all code therein…]

• GitHub, GitHub’s parent company Microsoft and OpenAI have teamed up to deliver a tool that comes up with source code for programmers to use as they work.
• The system can make recommendations in almost any programming language, although it works best with the popular JavaScript, Python and TypeScript languages.
• OpenAI will release the underlying online service for other companies to use this summer.

…The new software makes coding faster, Friedman said in an interview last week. Hundreds of developers at GitHub have been using the Copilot feature all day while coding, and the majority of them are accepting suggestions and not turning the feature off, Friedman said.

…“You don’t want to go read Twilio’s API documentation. It knows all that stuff. It’s actually quite reliable at it”, he said. Brockman calls this work last-mile programming, and he said that having computers take care of it leads to speed improvements. Microsoft’s chief technology officer, Kevin Scott, has seen that happen firsthand. “It can save me from having to dive through a whole bunch of documentation to get a tool to do a thing that I know it’s capable of doing, and that is so good for productivity”, he said. “I can’t even tell you the number of hours I’ve wasted trying to figure out the right way to do a relatively prosaic thing, just navigating the complexity of these tools.”

…It supports almost every programming language, but it’s been designed to work best with JavaScript, Python and TypeScript, Friedman said. GitHub Copilot will first appear in Microsoft’s Visual Studio Code⁠, a free open-source product, and Microsoft plans to incorporate it into the commercial Visual Studio product in the future…The underlying technology won’t be only Microsoft’s to use. OpenAI will release the Codex model this summer for third-party developers to weave into their own applications, Brockman said.

…Engineers fed the model “many, many terabytes of public source code out there”, Friedman said.

…Over the next few months, people experimented with the model to see what it could do, both useful and silly—for instance, one engineer made a website that could design a button that looked like a watermelon. Brockman reached out to Friedman, as he was running a key destination where millions of programmers work on code and things proceeded from there.

In software development through integrated development environments (IDEs), code completion is one of the most widely used features. Nevertheless, majority of integrated development environments only support completion of methods and APIs, or arguments.

In this paper, we introduce IntelliCode Compose—a general-purpose multilingual code completion tool which is capable of predicting sequences of code tokens of arbitrary types, generating up to entire lines of syntactically correct code. It leverages state-of-the-art generative transformer model trained on 1.2 billion lines of source code in Python, C#, JavaScript and TypeScript programming languages.

IntelliCode Compose is deployed as a cloud-based web service. It makes use of client-side tree-based caching, efficient parallel implementation of the beam search decoder, and compute graph optimizations to meet edit-time completion suggestion requirements in the Visual Studio Code IDE and Azure Notebook.

Our best model yields an average edit similarity of 86.7% and a perplexity of 1.82 for Python programming language.