Code from an assistant still needs a test you can run

Start here

Someone who does not write code can now ask an assistant for a script to rename a folder of files or clean up a spreadsheet export, and often get something that runs. The task is not learning to read every line — it is learning what to check before running code you did not write and cannot fully audit yourself, on a machine or a dataset you care about.

What the documents say

The evidence on correctness and safety comes from two different kinds of study. A 2021 paper, Asleep at the Keyboard?, deliberately built 89 scenarios designed to trigger known vulnerability categories from MITRE's high-risk list, generated 1,689 programs from GitHub Copilot, and found that about 40% contained vulnerabilities — a figure from adversarially designed prompts on an early version of the tool, not a random sample of everyday requests. GitHub's own 2022 study, Research: quantifying GitHub Copilot's impact on developer productivity and happiness, ran a task-completion experiment where a group using Copilot finished an HTTP-server task at a higher completion rate (78% versus 70%) and in roughly half the time, alongside a self-reported satisfaction survey of participants who were mostly professional developers; this is the vendor's own analysis of its own product, useful but not independent. GitHub's current Copilot documentation tells users to apply the same review to an AI-generated pull request as to any human contribution, and to check suggestions for matches with public code.

Check this

If you cannot read the code, you can still run it against a case where you already know the right answer. Give the script a small, controlled input — a test file, a folder with three items instead of three thousand — and confirm the output matches what you expect by hand before pointing it at anything real. Ask the assistant to explain what each part does in plain language, then check that explanation against what actually happened when you ran it; a mismatch there is a warning sign even without reading the syntax.

What holds and what fails

Speed and completion-rate gains, as GitHub's own study reports them, describe professional developers working on a bounded, well-specified task, not a non-programmer's unfamiliar and open-ended request. The vulnerability study's figure describes adversarial prompts built to find known weaknesses, not the rate for an everyday personal script, but it establishes that the failure mode exists and was not rare when researchers looked for it. This is an editorial synthesis of two differently designed studies, not a single combined statistic.

• Test any script on a small, known case before running it on real data.
• Back up files before letting a script rename, move, or delete them.
• Ask for a plain-language walkthrough and compare it to what actually ran.

A script that runs without an error message has not been checked; it has only avoided crashing, which is a lower bar than doing the right thing.