SQLite Critical CVEs or LLM Slop?

	SQLite Critical CVEs or LLM Slop?(research.jfrog.com)
	721 points by ymir_e 71 days ago \| 370 comments
	tl;dr: JFrog researchers found that a GitHub repo (programmervuln/cveadvisory-) published 55 SQLite-related CVEs that appear to be LLM-generated fabrications—citing non-existent functions, wrong line numbers, and fake patches—yet NVD flagged them critical and Red Hat initially scored one 10.0. Only 1 of the 55 advisories contained a real bug. The incident highlights how NIST's paused deep analysis since February 2024, combined with MITRE's lack of identity verification, lets AI-generated "slop" CVEs pollute vulnerability databases and waste security teams' time.
	HN Discussion: ↑LLMs are probabilistic tools being misapplied to domains requiring certainty, leading to unreliable outputs ↑The lack of validation and proof-of-concept requirements in the CVE submission process is a fundamental flaw ↑AI slop degrades signal-to-noise ratio and creates attack vectors through flooding vulnerability databases ↑Automated verification and PoC reproduction checks should be mandatory to filter out fake reports ↑This represents a new generation of unskilled actors using AI tools to punch above their capabilities