AI agents select known-vulnerable dependency versions 50% more often than humans. Worse, the vulnerable versions they pick are harder to fix, requiring major-version upgrades far more frequently.
大多数人认为AI编码助手会比人类更安全地选择依赖项,但作者发现AI实际上选择已知漏洞版本的概率比人类高50%,而且这些漏洞更难修复。这是因为AI优化的是'功能是否工作'而非'是否安全',这挑战了AI辅助开发的安全假设。