Now AI is making fake vulnerabilities and polluting the ecosystem. A batch of critical- and high-rated SQLite CVEs that appeared in the NVD with CISA-supplied enrichment last week turned out to be technically bogus, according to security researchers, and their path into widely used databases exposes weaknesses in the CVE pipeline.
Software supply chain security outfit JFrog reported last week that six supposed SQLite vulnerabilities published in a larger batch by a new, obscure GitHub repository were all complete garbage. Running the advisories through an AI checker suggested they were likely AI generated, JFrog said, and, upon testing, it found that none of the six SQLite reports, which carried CVSS scores ranging from 9.8 to 7.5, described a reproducible vulnerability.
One, an alleged use-after-free vulnerability in the open source database that Red Hat initially assigned a maximum 10.0 CVSS score to before lowering it, relied on a function that didn't exist in the affected SQLite version. Another UAF vulnerability with a 9.1 CVSS score cited source lines that weren't even related to the supposed flaw. When JFrog tested the accompanying proof-of-concept, it executed a valid query with no memory leaks or errors. The other four SQLite CVEs from the repo that JFrog tested were similarly fake.
The other 49 CVEs in the questionable GitHub repo claimed to be security vulnerabilities in the open-source RAW image processing library libraw and Arduino audio decoding library ESP32-audioI2S. While JFrog didn't test those as extensively, it said all are just as fake as the rest, aside from one which "contained a real bug wrapped in unverified CVE metadata."
A message posted to Openwall's OSS-Security mailing list on Friday indicated that MITRE had rejected the whole repo's worth of vaporous vulnerabilities, but the whole thing should serve as an important lesson, poster and Oracle Solaris engineer Alan Coopersmith pointed out.
"MITRE and most other CNAs which assign CVEs for code they don't produce themselves operate on the honor system, and trust CVE requesters to have verified the information they provide," Coopersmith noted in the OSS-Security post. "The CNA is often not in a position of being able to verify the report themselves."
[...] "Because no step in today's system actually requires a proof-of-concept or bug reproduction, a plausible-sounding fake advisory can slide right through the pipeline and end up in GitHub Security Advisories, downstream databases, and enterprise scanners," JFrog said. "This incident demonstrates a systemic issue with automated vulnerability ingestion."
What that means for security professionals, aside from having to deal with polluted vulnerability databases, is that bad advisories could waste time better spent chasing real issues. Because reputable databases can ingest unverified records, JFrog recommended several checks before defenders act on a newly published CVE.
[...] "Generative AI has lowered the effort required to produce a plausible-looking advisory to close to zero, while the effort required to verify one, review the source code, build the affected version, reproduce the PoC, is unchanged," Berger told us in an email. "That asymmetry means that even well-resourced defenders and maintainers cannot manually validate every incoming report ... this is a challenge the whole industry is facing in the AI era."
(Score: 2) by looorg on Saturday August 08, @10:37AM (1 child)
This seems to be happening to a lot of projects now. The bug report queue gets fill with slop and automated reports, that usually make little sense. Often I assume in wanting "easy" bug report rewards. In some regard perhaps it's the same as a lot of other AI writing, when reality is not enough it starts to invent its own and just make shit up. If it hallucinates in other writing why not do it here to. After all what is really real.
That said perhaps there are bugs hidden so deep and so obscure that most humans just wouldn't find them. But then I'm not sure this is helping. So they are probably in the right to just slam that reporting door in the face of friend AI. To much effort, to little reward.
(Score: 2) by driverless on Sunday August 09, @11:07AM
It's been going on for a long time now, it's just that AI has industrialized the process. It's not for nothing that CVEs are sometimes referred to as "CV-Enhancements".
(Score: 3, Informative) by SomeGuy on Saturday August 08, @12:48PM
Now SOMEONE is using AI is making fake vulnerabilities...
(Score: 3, Insightful) by VLM on Saturday August 08, @03:55PM (1 child)
Its the usual problem of socialize the costs and privatize the rewards.
When the copy and pasted or fully automated AI report is accurate, it goes on some individual human's personal resume as "proof" they should be hired as a cybersecurity guy despite not knowing anything and not having any experience in the field.
When the report is inaccurate, which it often is, everyone pays the cleanup cost and no one is personally responsible for AI mistakes.
People running the resume-stuffer lottery need to get blacklisted out of the cybersecurity industry, if not prosecuted for something like littering.
In the long run there's too many scammers and not enough filters and "open" software development like on github/gitlab is simply doomed. If you click permit on your bugtracker or pull request settings you'll be absolutely blown out of the water by infinite scammers. That era of openness is just dead now. Oh well. Some ack this and are shutting down public access, others refuse to ack it and complain a lot, some will never stop complaining probably. I imagine there's STILL people online in 2026 whining about the unfairness of not being able to run a SMTP open relay as an architectural choice. Oh well.
(Score: 2) by jb on Sunday August 09, @05:50AM
It is unfair. Back in antediluvian times, open relays had many legitimate uses (not the least of which was source-routing mail, which made it easy to get past broken MTAs that might otherwise be in the path). Losing all that flexibility and freedom just because of a bunch of bad eggs is absolutely unfair.
But "unfair" is not the same as "unreasonable". I think everyone today accepts that blocking anything that comes through an open relay is a perfectly reasonable policy for any postmaster to enforce, even though it's a manifestly unfair one (because it punishes victims, whereas almost all of the perpetrators continue to get off scot free).
The distinction can go the other way too: for example to offer a bounty of say $500k for the head of any proven spammer would be a much fairer policy, but also a very unreasonable one (and outright illegal, so don't try this at home!).
(Score: 1, Interesting) by Anonymous Coward on Sunday August 09, @02:20AM
(Score: 2) by Ingar on Sunday August 09, @06:56AM
Stor titl will now be abbrev to sav bit.
Love is a three-edged sword: heart, soul, and reality.