SQLite Critical CVEs or LLM Slop? (JFrog blog)

The JFrog blog examinessome reported vulnerabilities in SQLite, some of which made their wayinto high-profile vulnerability databases, that turned out to be entirelyfabricated by LLMs.

These LLM slop CVEs can cause organizations to waste timeinvestigating and patching vulnerabilities that do not actuallyexist, as well as polluting vulnerability databases. Inenvironments where Critical vulnerabilities are automaticallyprioritized or tickets are opened based on vulnerability scores,such fabricated CVEs can turn into a real burden.

In environments where AI is used to automate vulnerability triageand remediation this becomes even more concerning. An AI agent thatencounters a fabricated CVE may attempt to locate the vulnerablefunction, generate a patch, or recommend changes based on code thatdoes not even exist. Instead of helping security teams remediatereal vulnerabilities, it can lead them down a completely wrongpath, potentially introducing unnecessary changes and wasting time.