Critical Flaws in ChatGPT, Copilot, Gemini Generated Scripts Expose Users

Key Takeaways

• A new academic study found that every automation script generated by leading AI models – ChatGPT, Microsoft Copilot, and Google Gemini – contained exploitable security vulnerabilities.
• The research identified 45 individual security findings, deduplicated into 17 distinct vulnerability classes, affecting all AI-generated scripts regardless of the platform used.
• Critical flaws like Server-Side Request Forgery (SSRF), Path Traversal, and various Injection Flaws were prevalent, posing significant risks to enterprise environments.
• The study emphasizes the critical need for mandatory human code reviews and restricted execution permissions for AI-generated code before deployment.

Systemic Vulnerabilities Found in AI-Generated Code Across Top LLMs

A recent academic investigation by Beacom College of Computer & Cyber Sciences has uncovered a troubling reality: every single automation script produced by prominent artificial intelligence models, including OpenAI’s ChatGPT, Microsoft Copilot, and Google Gemini, harbored exploitable security vulnerabilities. This groundbreaking study highlights substantial risks for organizations increasingly integrating AI tools into their development workflows, particularly when deploying AI-generated code without rigorous security oversight.

To ensure an unbiased evaluation of the security posture of AI-generated code, researchers employed identical, standardized prompts across ChatGPT, Microsoft Copilot, and Google Gemini. The prompts focused on three common enterprise automation scenarios:

• Web Scraping: Scripts designed for automated data extraction.
• Email Automation: Programs for managing automated messages and notifications.
• File Workflow Automation: Tools for monitoring and managing file systems.

In total, nine distinct Python scripts were generated. The research team then used Anthropic’s Claude Code to simulate a realistic scenario where a non-expert user might vet these AI-written scripts. This automated review process identified 45 individual security findings, which were consolidated into 17 unique vulnerability classes. Each vulnerability was meticulously scored using the CVSS 3.1 framework, mapped to the OWASP Top 10, and cross-referenced with the MITRE ATT&CK framework.

Security Flaws Pervasive Across All AI Platforms

The study unequivocally demonstrates that these security deficiencies are systemic across AI platforms rather than being specific to any single vendor. The number of vulnerabilities remained consistently high across all models: ChatGPT’s scripts contained 13 vulnerabilities, Copilot’s had 14, and Gemini’s exhibited 12, showing negligible statistical variation.

Out of the 17 distinct vulnerability classes identified, a significant 9 (53%) were present in code generated by all three AI models, and 14 (82%) appeared in scripts from at least two platforms. This widespread overlap suggests that the security risks are intrinsically linked to the nature of the requested task itself, rather than the specific AI provider utilized.

Primary Vulnerabilities Observed Across Platforms:

The research pinpointed several critical vulnerability types consistently appearing in the AI-generated code:

• Server-Side Request Forgery (SSRF): Every web scraper script contained unvalidated URL parameters, potentially allowing attackers to probe internal networks.
• Path Traversal: Unsanitized file paths were found across web scraper, email, and file-watcher scripts, enabling unauthorized access to file systems.
• Injection Flaws: All email automation scripts were susceptible to email header and template injection, which could facilitate message tampering or sophisticated phishing attacks.
• Symlink Vulnerabilities: Flaws in all file-watcher scripts could lead to arbitrary file manipulation through symbolic link exploitation.
• Broad Exception Handling: The widespread use of overly broad try-except blocks was observed, which can silently suppress security-critical errors, making them difficult to detect and remediate.

The study cataloged these 17 distinct vulnerability classes, revealing that critical flaws impacted network handling, file systems, and input parsing logic.

A detailed CVSS 3.1 analysis, as outlined in the published research paper, further revealed that a Pareto analysis indicated that just 11 of the 17 vulnerability classes accounted for approximately 80% of the total weighted risk. Critical issues such as SSRF, template injection, email header injection, and path traversal topped this list. When mapped against the Lockheed Martin Cyber Kill Chain, these identified flaws could enable various stages of an attack, including initial access, execution, credential access, and lateral movement.

The inherent danger of these vulnerabilities is amplified by the nature of automation scripts, which typically execute with the permissions of the user or host environment. An unvetted script could interact with sensitive corporate resources like shared drives, internal SMTP servers, and local subnets without requiring additional privilege escalation. These risks are further compounded by broader threats within the AI ecosystem, such as prompt injection attacks targeting automated code generation tools or vulnerabilities in AI workflows that could expose underlying enterprise services to exploitation.

What You Should Do

• Implement Mandatory Code Reviews: All AI-generated code, regardless of its perceived simplicity or origin, must undergo rigorous human security reviews before being deployed to production environments.
• Restrict Execution Permissions: Configure systems to prevent LLM-generated scripts from running with elevated privileges or unrestricted access to sensitive network resources, such as shared drives or internal services.
• Prioritize Remediation: Utilize CVSS, OWASP, and MITRE ATT&CK frameworks to identify and prioritize the remediation of high-severity flaws, focusing initially on issues like SSRF, path traversal, and various injection vulnerabilities.
• Educate Development Teams: Continuously educate developers and other personnel involved in AI-assisted coding about the inherent security risks, emphasizing that functional code does not automatically equate to secure code.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.