AI slop pollutes the CVE pipeline with fake vulns

Now AI is making fake vulnerabilities and polluting the ecosystem. A batch of critical- and high-rated SQLite CVEs that appeared in the NVD with CISA-supplied enrichment last week turned out to be technically bogus, according to security researchers, and their path into widely used databases exposes weaknesses in the CVE …

[IGotOut]

I'm sure slimy Sam Altman...

Will spin this a positive.

Look how powerful AI is, it can even find bugs in software that doesn't exist. It's so amazing. One day, it will even be Super Intelligent to the extent it can find bugs in alien software yet to be discovered!

Now give me another Billion for my slop machines.

[Anonymous Coward]

What we need is an AI to filter out the reports

Just kidding

[Mr. Flibble]

Death by a thousand slops

https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/

[jake]

Hands up everybody who didn't see this coming.

And now, everybody with their hands up cancel your subscription to the Internet.

[rgjnk]

Could be worse

At least there was a little bit of effort in this slop.

Wander onto the issues part of various Github projects and you'll find they're swamped under some utter low effort empty AI dross, like someone has set their tooling up to create an issue any time their system had an error and to just dump in the error with no expansion. Even if that's because they hadn't set the target up.

Loads of it, and all from one or two parts of the world if the account names were a clue.

[Fred Dibnah]

Re: Could be worse

To help someone like me who isn’t a coder or an expert on AI, could you list some examples so we know what to look for? Ta.

[DrewPH]

Kill it

Kill it all. All AI. With fire.

[redpola]

Hi, AI. For us to even look at all your new defect reports, we are going to need an easily-executed repro case (ideally one click) for each one. That’s to even get to triage.

[Lee D]

So at what point are we just going to go back to entirely ignoring slop, regardless of its source? And not pumping trillions into this worthless junk?

[jake]

At what point? As soon as the bubble bursts, of course.

Of course there will always be some holdouts who will continue to try to make their investment money back ...

[DLYONS]

How many of these CVE's are hallucinations i do wonder

So many CVE's coming out from AI SOOOOOOO many, and only a very few would would understand them enough to check there accuracy. I do wonder if there real or made up. That's the problem with all AI "work" i see.