Every AI-generated automation script tested contained exploitable vulnerabilities.

Kahn and Hastings collected code from ChatGPT, Microsoft Copilot, and Google Gemini using identical prompts across three automation domains, then ran a standardized vulnerability review scored with CVSS v3.1 and mapped to OWASP Top 10:2021 and MITRE ATT&CK (arXiv 2607.20713). Every script had exploitable vulnerabilities. Nine of 17 identified vulnerability classes appeared in all three models' output, 14 of 17 in at least two, and weighted CVSS scores differed by less than 10% across platforms. The conclusion is the useful bit for anyone comparing vendors: risk tracks the task category, not the model. Switching providers buys you nothing. The real variable is whether generated automation ships without review.