Reddit study of LLM-IDE complaints finds permissions, not models, drive security failures

Gias Uddin and colleagues at York University and the University of Calgary mined 1.1M Reddit posts down to 446 posts and 6,000+ comments to build a taxonomy of security and privacy failures in LLM-native IDEs, led by lack of transparency (45.9%), unauthorized file operations (43.1%), and unsafe code generation (18.2%). The failures trace to what the agent is permitted to access and do, not to the underlying model — which puts the fix in permission scoping and audit surfaces developers control. The paper is accepted at ASE 2026.

Source: theregister.com ↗