Users report genuine automation wins, but ~600 CVEs in under a year, prompt-injection risk and maintenance burden temper it. No independent