Preprint: https://arxiv.org/abs/2607.26390
Security and Privacy Incidents Reported by Developers #
LLM-native IDEs (LIDEs) increasingly allow AI agents to read repositories, execute commands, and modify code, introducing significant security and privacy risks. Developers regularly report incidents on Reddit involving leaked API secrets, unauthorized access to system files, and file deletion on live servers. In one case, despite configuring both .gitignore and .copilotignore to exclude a secrets file, Copilot read and attempted to modify it while debugging a database connection issue, exposing live API keys and credentials. This study systematically analyzes such incidents and develops a taxonomy to characterize the reported security and privacy risks.
Methodology #
The authors followed a three-stage selection pipeline. First, they collected 15.4 million posts and comments from 46 subreddits related to LLM coding tools (January 2023–March 2026). Second, a high-recall LLM classifier filtered these to 3,801 candidate posts. Third, manual verification identified 446 relevant posts, along with 6,280 associated comments, for qualitative coding. Open and axial coding were then applied to develop the taxonomy.
Major Findings #
The study identifies 16 popular LIDEs in the Reddit posts, with Cursor (34.5%) and Claude (23.7%) dominating the discussions. Although the authors do not explicitly interpret this distribution as evidence of higher risk, it reflects the prevalence and use of these tools. The authors developed a taxonomy of 32 issues across 10 categories, covering security (297 posts) and privacy (194 posts) concerns:
Security issues:
- ***** Unauthorized File Operations (43.1*%)** denoted the most frequent category, including unauthorized file access, modification, and deletion; destructive deletions accounted for 28.3% of security incidents.
- Operational Safety Issues (23.9%) included wiping production databases, altering OS files, and prompt injection through malicious pull requests.
- Unsafe Code Generation (18.2%): involved vulnerable code, hallucinated logic, and untrusted dependencies.
- User-Specified Constraint Violations (16.5%) included ignoring .cursorignore, allowlists, and approval gates.
- Third-Party Tool Integration Risks (4.7%) involved malicious or misconfigured MCP servers.
Privacy issues:
- Lack of Transparency (45.9%) reported unclear or vague policies and settings made data collection.
- Unauthorized Data Access (23.7%) found cases where user private data, secrets or PII was accessed without consent.
- Privacy Leakage Violations (15.5%) involved long-term conversation-data retention and leaked API keys.
- Unauthorized Transmission & Collection (11.9%) identified cases where telemetry and plaintext data were shared externally.
- Context Integrity Failures (8.8%) involved data bleeding across user sessions or unrelated projects.
Additionally, the authors show that 7 out of 10 issues stem from system-level design choices (how the IDE grants access, executes actions, and manages context) rather than from the underlying LLM’s reasoning itself.
Mitigation Strategies #
With little built-in protection, developers commonly suggested 13 self-devised mitigation strategies, grouped into five categories: Configuration Management (33%, e.g., restricting permissions, disabling telemetry), Code Governance (31%, manual review, version control as a safety net), Data Protection (13%, isolating secrets via .gitignore), Isolation (13%, sandboxing or running local models), and External Guidance (9%, consulting vendor docs). The reliance on workarounds signals a real trust gap between what developers expect and what LIDEs actually guarantee.
Takeaways for the Community #
- For LIDE vendors, treat the LIDE as a software system first, not just an LLM wrapper; add a native verification layer before code changes are applied, and expose clear execution logs.
- For developers, don’t “vibe code” blindly. Review AI-suggested changes the same way you’d review a colleague’s PR, and keep secrets out of the agent’s reach entirely.
- For researchers, the field needs LIDE-specific security benchmarks, similar to how SWE-bench standardized coding-capability evaluation.