AI Coding Tools Pose Security Risks: Excessive Permissions Lead to Data Loss and Malicious Code

Researchers from York University and the University of Calgary analyzed Reddit posts about coding AI and found that AI agents with excessive permissions can overwrite files, delete important data, and even generate malicious code. The study collected 3,801 popular posts tagged with large language models from February 2023 to March 2026, filtered 446 posts about coding AI security, and analyzed over 6,000 user comments.

The research shows that Reddit saw the most questions about AI coding around summer 2025, peaking in July 2025. The tool with the most reported issues was Cursor, followed by Claude, Codex, Copilot, and Windsurf. Cursor mainly faced runtime security issues and unauthorized data access, affecting production environments, while Claude encountered risks related to third-party tool integration.