Talk Around Town: AI-Hallucinated SQLite CVEs May Have Fooled NVD and CISA, JFrog Claims

What Folks Are Saying Down at the Feed Store

Well, butter my biscuit and call it a vulnerability — according to JFrog Security Research, somebody waltzed into the CVE system like a fox into an unlocked henhouse. JFrog says a brand-new GitHub account, going by the handle 'programmervuln/cveadvisory-', turned up recently and started pumping out SQLite vulnerability advisories faster than a county fair funnel-cake vendor on a Saturday. JFrog's analysis, published on its own research blog, claims the account dropped a batch of advisories that appear to be almost entirely fabricated by a large language model — what the company's researchers colorfully call 'LLM slop.'

According to JFrog, the National Vulnerability Database flagged those advisories as critical severity, and CISA's Authorized Data Publisher initially signed right along with those ratings — like a notary stamping a document written in crayon without reading the thing. JFrog is itself a CVE Numbering Authority, which gives its technical assessment some institutional weight, though it bears repeating that this finding originates from the company's own self-published research blog and has not yet been independently replicated by a second named security firm doing its own code-level dig.

What We Actually Know for Certain

Here is the solid ground, such as it is. JFrog says its researchers went and checked the receipts: the source code cited in these advisories reportedly did not exist in the stated SQLite versions, the proof-of-concept payloads failed to crash anything when tested, and none of the CVEs show up on SQLite's own official advisory page. That last detail is about as red a flag as a barn painted red — if the software's own maintainers don't know about a critical vulnerability, something has gone sideways.

JFrog's broader audit of 55 advisories from the same GitHub account concluded, according to the company, that 54 were completely fabricated. The fifty-fifth, JFrog says, did reference a real bug — though it was wrapped in unverified CVE metadata — so the whole barrel is not entirely rotten apples, just mostly. A Dutch-language security outlet, Security.NL, corroborates that at least one CVE number from the batch, CVE-2026-51302, was subsequently withdrawn, citing both JFrog and SUSE as parties who flagged the issue, though SUSE's direct English-language statement has not been independently located for this article.

For CVE-2026-51302 specifically, JFrog reports that Red Hat initially handed it a CVSS score of 10.0 Critical — the nuclear-option rating — before later walking that back to 7.6 High. That score change is observable in screenshots JFrog includes in its post, providing one piece of third-party-checkable evidence. Whether Red Hat concluded the CVE was entirely fabricated or merely over-scored remains unclear from available sources.

What Nobody Has Nailed Down Yet

Now here is where we need to slow the truck down and check the tires. The central claim — that these advisories are LLM-generated fabrications rather than merely sloppy or mistaken human-written ones — rests almost entirely on JFrog's own published analysis. No second independent security firm has yet published its own technical replication of JFrog's specific code-level findings as of this writing. The Dutch-language Security.NL article does attribute the 'AI-hallucinated' characterization to JFrog and SUSE together, but that article itself leans heavily on the JFrog post, so it does not constitute fully independent corroboration.

It is also worth noting that NVD and CISA's ADP, by initially rating these CVEs as critical without apparent independent code verification, were operating in direct contradiction to what JFrog now claims the evidence shows. That disagreement has not been formally resolved in any public NVD or CISA statement that has been located. And since one of the 55 advisories does appear to reference a genuine bug, a blanket characterization of the entire account's output as pure AI fiction is, strictly speaking, an overstatement — albeit a minor one given the 54-to-1 ratio JFrog describes.

The Scarier Downstream Problem, Per JFrog

JFrog does not stop at pointing a finger at the CVE pipeline — the company also raises a concern that is worth flagging as the company's own analysis, not settled reporting. According to JFrog, in environments where AI agents are set loose to automate vulnerability triage and remediation, a fabricated CVE could send that agent on a wild goose chase through a codebase looking for a function that flat-out does not exist. The agent might then generate a spurious patch, recommend a bogus configuration change, or steer a security team down entirely the wrong dirt road — all with the confidence of a hound dog that has never once been wrong about finding a coon, until now.

JFrog also identifies, according to its research post, a set of warning signs common to the fabricated advisories: no vendor corroboration, absent commit history, contradictions in the metadata, and references to functions that do not appear anywhere in the claimed target version of the software. The company frames these as a practical checklist for security teams who want to spot similar noise in the future. That framing is JFrog's own guidance, not an independently validated methodology, but it is at minimum internally consistent with the specific examples the company describes.

Our Take: A Leaky Pipeline With Real Consequences

This is analysis, not reporting, so label it accordingly. If JFrog's account holds up under scrutiny — and the observable NVD metadata, the Red Hat score revision, and the CVE withdrawal at least partially support the broad strokes — then what this episode illustrates is that the vulnerability-ingestion pipeline was built for a world where fabricating plausible-sounding technical advisories at scale required genuine expertise and significant effort. A language model changes that math considerably, like putting a tractor engine in a go-kart: the system was not designed for that kind of throughput.

The practical danger here is not just wasted analyst time, though that alone would be costly enough to matter. It is that the CVE ecosystem feeds into downstream tooling — scanners, patch managers, AI remediation agents — that often treats a critical NVD rating as ground truth rather than a starting point for verification. Garbage in, garbage out, as they say, except in this case the garbage is wearing a CVSS score of 10.0 and a CISA badge. Until there is mandatory technical verification before a CVE gets a severity rating slapped on it, the system appears to be operating on an honor code that someone, or something, has now decided to test.