A new academic study from Beacom College of Computer & Cyber Sciences has revealed that every automation script generated by leading AI models ChatGPT, Microsoft Copilot, and Google Gemini contained exploitable security vulnerabilities.
As enterprises increasingly rely on AI tools to accelerate development workflows, these findings highlight serious risks associated with deploying unreviewed AI-generated code directly into production environments.
To evaluate the security quality of AI-generated code without prompt bias, researchers issued identical, standardized prompts across ChatGPT, Microsoft Copilot, and Google Gemini. The test suite focused on three common enterprise tasks:
- Web Scraping: Automated data collection scripts.
- Email Automation: Automated messaging and notification handlers.
- File Workflow Automation: File-system monitoring and management tools.
In total, nine Python scripts were generated. The researchers evaluated the code using Anthropic’s Claude Code to simulate how a non-expert user might realistically vet AI-written scripts.
This automated review process surfaced 45 individual security findings, which were deduplicated into 17 distinct vulnerability classes. Each vulnerability was scored under the CVSS 3.1 framework, mapped to the OWASP Top 10, and cross-referenced with the MITRE ATT&CK framework.
Security Flaws Found in Every Script Generated
The research demonstrates that security flaws are systemic rather than brand-specific. Vulnerability counts remained remarkably consistent across platforms: ChatGPT’s scripts contained 13 vulnerabilities, Copilot’s contained 14, and Gemini’s had 12, with statistically negligible variance.
Out of the 17 unique vulnerability classes identified, 9 appeared in code generated by all three AI models (a 53% overlap), and 14 were present in at least two platforms (an 82% overlap).
This indicates that security risks are inherently tied to the nature of the requested task rather than the choice of AI provider.
Primary Vulnerabilities Observed Across Platforms:
- Server-Side Request Forgery (SSRF): Unvalidated URL parameters in every web scraper script, allowing potential attackers to probe internal networks.
- Path Traversal: Unsanitized file paths across scraper, email, and file-watcher scripts.
- Injection Flaws: Email header and template injection in every email automation script, enabling message tampering or phishing.
- Symlink Vulnerabilities: Flaws in all file-watcher scripts leading to arbitrary file manipulation.
- Broad Exception Handling: Overly broad
try-exceptblocks that silently swallow security-critical errors.
The researchers cataloged 17 distinct vulnerability classes across the generated codebase.
The detailed CVSS 3.1 breakdown illustrates that critical flaws span network handling, file systems, and input parsing logic:
As detailed in the published research paper, a Pareto analysis revealed that just 11 of the 17 vulnerability classes account for roughly 80% of total weighted risk. Critical issues such as SSRF, template injection, email header injection, and path traversal top the list.
Mapped against the Lockheed Martin Cyber Kill Chain, these flaws cover initial access, execution, credential access, and lateral movement.
Automation scripts inherently run with the permissions of the executing user or host environment. An unvetted script can interact with corporate shared drives, internal SMTP servers, and local subnets without needing secondary privilege escalation.
These risks compound when combined with broader threats in the AI ecosystem, such as AI prompt injection attacks targeting automated code tools or AI workflow vulnerabilities that expose underlying enterprise services to exploitation.
Recommended Organizational Safeguards
Organizations should establish clear guardrails around AI-assisted software development:
- Mandate Code Reviews: Enforce security reviews for all AI-written code prior to production deployment, regardless of script complexity.
- Restrict Execution Permissions: Block LLM-generated scripts from running with elevated permissions or unrestricted access to shared network drives.
- Prioritize High-Severity Fixes: Utilize CVSS, OWASP, and MITRE ATT&CK mappings to remediate SSRF, path traversal, and injection flaws first.
- Educate Staff: Remind developers and non-technical employees that functional code does not equate to secure code.
