A Microsoft-owned tool powered by artificial intelligence is designed to make life easier for programmers, but some developers say it may be repurposing some of the billions of lines of code it was trained on without permission.
The tool, called CoPilot, was released by GitHub, a Microsoft subsidiary that is used by millions of people to share source code and organise software projects. CoPilot uses powerful neural network tools developed by OpenAI to solve programming problems by scouring vast numbers of examples of existing solutions, both from GitHub and elsewhere, and learning how to create similar solutions. It then suggests code based on a human programmer鈥檚 work in progress or English descriptions of the functionality needed.
But sometimes CoPilot may directly plagiarise its training data, says at software company Sentry. He has found that it is possible to prompt CoPilot to suggest copyrighted code from the 1999 computer game Quake III Arena, complete with comments from the original programmer. This code cannot be reused without permission.
Advertisement
鈥淵ou can definitely make it recite code that is almost entirely in the training set where there鈥檚 no originality happening,鈥� says Ronacher, although he says it should be possible to adjust CoPilot so that it warns the user if code being output is very close to original work.
A more difficult problem to solve is that many of the software projects that CoPilot has been trained on are released under free software licences such as the General Public License, or GPL, that only allow derivative works if they are also freely released. This doesn鈥檛 stop them being used commercially 鈥� 鈥渇ree鈥� in this context means that people are free to modify the code 鈥� but it does mean that people using CoPilot would in theory also be required to release any source code they create for other people to use. However, the says that copyright for the code it generates belongs to the programmer using it.
Some developers have already taken action to protect their work. at RepRap, an open source 3D printer project, says CoPilot is a great idea but anything it creates must itself be open source. He has altered the wording of the licence under which he releases software: 鈥淚f any part of RepRap covered by the GPL is used to train any AI, then all the products of that AI must be released under the GPL as free software.鈥�
CoPilot may also raise security issues. One developer 鈥� a username and password unique to a certain user which is used to access features of another piece of software or website. It is good practice to remove these keys from open source code before publicly releasing it, but this is sometimes overlooked.
The tool鈥檚 website says that about 0.1 per cent of CoPilot code suggestions may contain 鈥渟ome snippets鈥� of verbatim source code from the training set. The company also warns that it is possible for CoPilot to output genuine personal data such as phone numbers, email addresses or names and that outputted code may offer 鈥渂iased, discriminatory, abusive, or offensive outputs鈥� or include security flaws. It says that code should be vetted and tested before use.
at UK law firm decoded.legal says that GitHub has made a 鈥渂ald assertion鈥� that it can 聽analyse code in the way CoPilot does under the in the US, but the position in the UK is less clear.
at the University of Bristol, UK, agrees that CoPilot could be allowed under US copyright law, which is less prescriptive but says it is a grey area in the UK that needs to be tested in court. The US fair use is a broader, less defined and altogether more unpredictable defence. UK copyright law tends to offer a much clearer definition of what is and isn鈥檛 acceptable.
鈥淚鈥檓 very keen for it to be tested, because I want to know,鈥� says Harn Lee.
Such a legal challenge may be difficult, says Brown. 鈥淚t wouldn鈥檛 surprise me if someone was willing to challenge them over it, but I doubt it would be someone with comparable resources to GitHub.鈥�
Microsoft and OpenAI didn鈥檛 respond to requests for comment, while GitHub declined to comment.
