Larson: Are insecure code completions a vulnerability?

Seth Larson, the Python Software Foundation's securitydeveloper-in-residence, has writtenabout the difficulty in classifying insecure code completion inthe PyCharm IDE usingits FullLine code completion plugin. Larson discovered that the plugin,which uses a local "deep learning module" to offer code completions,suggests code that would lead to severe vulnerabilities. He was unsurewhether it warranted a CVE or not, however:

I reported this behavior to JetBrains for "Full Line Code Completion" v253.29346.142and clearly their support staff weren't certain whether this defectwas a security vulnerability or not either. When I asked topublish a blog post about this behavior after they confirmedthis report wasn't a "direct security vulnerability" (whichI agree with) but then was asked not to publicize my report and referred toPyCharm's Coordinated Disclosure Policyso... which is it? Security vulnerability or not?

I ended up waiting the 90 days anyway and I didn't hear back withany substantive update from the development team. I double-checkedagain today using "Full Line Code Completion" v261.24374.152 and thebehavior is identical, suggesting the same insecure code for bothcontexts.

This isn't meant to be a specific dig at PyCharm or JetBrains, Ihave no-doubt that examples like this exist in every code generationmodel available.