Tab，Tab，Bug：AI集成IDE中Next Edit Suggestions的安全隐患
"Tab, Tab, Bug": Security Pitfalls of Next Edit Suggestions in AI-Integrated IDEs
AI总结：
本文研究了AI集成IDE中的Next Edit Suggestions安全问题，揭示了其复杂的上下文检索机制和潜在攻击向量，通过实验室测试和在线调查发现NES易受上下文污染和交易性编辑影响，需加强安全教育和防护措施。
摘要：
现代AI集成IDE正从被动代码补全转向主动Next Edit Suggestions（NES）。与传统自动补全不同，NES通过近期用户交互和整体代码库构建更丰富的上下文，建议多行、跨行甚至跨文件修改。这种演变显著简化了编程流程为逐标签交互，提高了开发效率。然而，现有研究几乎只关注LLM基于代码生成的独立安全影响，忽略了NES在现代AI集成IDE中的潜在攻击向量。本文首次系统研究NES系统安全问题，深入分析其机制，发现NES检索了更广泛的上下文，包括不可察觉用户行为和全局代码库检索，扩大了攻击面。通过实验室测试和在线调查发现，NES易受上下文污染和交易性编辑影响，且开发者对NES安全风险的认知不足，需加强安全教育和改进防护措施。
英文摘要：
Modern AI-integrated IDEs are shifting from passive code completion to proactive Next Edit Suggestions (NES). Unlike traditional autocompletion, NES is designed to construct a richer context from both recent user interactions and the broader codebase to suggest multi-line, cross-line, or even cross-file modifications. This evolution significantly streamlines the programming workflow into a tab-by-tab interaction and enhances developer productivity. Consequently, NES introduces a more complex context retrieval mechanism and sophisticated interaction patterns. However, existing studies focus almost exclusively on the security implications of standalone LLM-based code generation, ignoring the potential attack vectors posed by NES in modern AI-integrated IDEs. The underlying mechanisms of NES remain under-explored, and their security implications are not yet fully understood. In this paper, we conduct the first systematic security study of NES systems. First, we perform an in-depth dissection of the NES mechanisms to understand the newly introduced threat vectors. It is found that NES retrieves a significantly expanded context, including inputs from imperceptible user actions and global codebase retrieval, which increases the attack surfaces. Second, we conduct a comprehensive in-lab study to evaluate the security implications of NES. The evaluation results reveal that NES is susceptible to context poisoning and is sensitive to transactional edits and human-IDE interactions. Third, we perform a large-scale online survey involving over 200 professional developers to assess the perceptions of NES security risks in real-world development workflows. The survey results indicate a general lack of awareness regarding the potential security pitfalls associated with NES, highlighting the need for increased education and improved security countermeasures in AI-integrated IDEs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
