AI coding assistant

The category took shape with GitHub Copilot, released as a technical preview in June 2021 on OpenAI's Codex model and made generally available in June 2022. The Codex paper (Chen et al., 2021) also introduced the HumanEval benchmark of 164 hand-written Python problems scored by unit tests with the pass@k metric; the 12-billion-parameter Codex solved 28.8% at pass@1, a figure current models far exceed. Today's assistants combine several interaction modes in one editor extension: inline code completion, a chat panel, inline edits of a selection, multi-file edits, and increasingly an agent mode that blurs into a full coding agent.

Architecturally the interesting part is the context engine, not the model. On each request the client gathers candidate context (the current file around the cursor, other open and recently viewed files, symbols and types from the language server, snippets retrieved from a repository index by embedding or keyword search, and project instruction files), ranks it, and packs it into a token budget. Completion requests need latency in the low hundreds of milliseconds and so use small, fast models with tight budgets; chat and edit requests can afford larger models and longer contexts. Responses pass through post-processing: syntax checks, filters for secrets and offensive content, and optionally a filter that suppresses suggestions matching public code, which vendors offer to reduce licence exposure.

Data governance is the main enterprise concern. Whatever is in the assembled context leaves the workstation, including secrets in open .env files, personal data in test fixtures and proprietary code. Organisations should check the vendor's terms on retention and on training with customer code, configure content exclusions for sensitive paths, and, under GDPR, treat the provider as a processor where personal data may be sent, with a data processing agreement and a lawful basis for any transfer outside the EEA under Chapter V. Self-hosted or local models trade quality for control.

On code quality, the classic measurement is Pearce et al. (2022), who prompted Copilot with 89 security-relevant scenarios and found that about 40% of the 1,689 generated programs contained a CWE-listed weakness. Assistants reproduce patterns common in public code, including insecure ones, and repository content read as context can carry prompt injection that steers chat answers. Vendor productivity metrics such as acceptance rate measure how often suggestions are kept, not whether the resulting code is correct or maintainable, so teams should pair adoption with the same SAST, dependency scanning and review they apply to human-written code.