54 of 55 SQLite CVEs Were AI Slop
JFrog's security team looked into CVE-2026-51302, a CVSS 10.0 critical in SQLite, one of the most widely deployed pieces of software on Earth. The proof-of-concept doesn't reproduce. The cited functions don't exist in the claimed versions. Line numbers point past end-of-file. Pulling the thread: one GitHub repository had published 55 CVEs in four days, and 54 of them show the same fabrication pattern. LLM-generated vulnerability reports, rubber-stamped into the official pipeline: NVD and CISA's ADP flagged them critical without anyone reproducing anything. The story hit 685 points on Hacker News.
This failure mode is nastier than spam. CVE feeds are load-bearing: security teams auto-prioritize on CVSS scores, compliance scanners block builds, on-call engineers get paged. Fake criticals in SQLite mean thousands of teams burning real hours on nonexistent bugs. It's a denial-of-service attack on human attention, executed through a trust pipeline built in an era when writing a plausible advisory took actual effort. JFrog's red flags are worth stealing: no mention on the maintainer's official security page, no linked commit or PR in the references, empty CPE product definitions, cited functions that don't exist in the target version.
The 2026 security story keeps circling one theme: agents attacking, agents defending, and now the defenders' own database getting poisoned. The uncomfortable conclusion is that any pipeline accepting plausible-looking text at scale is now an attack surface, and "validate before you trust" just became a job description.
Write-up: https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/
← Back to all articles
This failure mode is nastier than spam. CVE feeds are load-bearing: security teams auto-prioritize on CVSS scores, compliance scanners block builds, on-call engineers get paged. Fake criticals in SQLite mean thousands of teams burning real hours on nonexistent bugs. It's a denial-of-service attack on human attention, executed through a trust pipeline built in an era when writing a plausible advisory took actual effort. JFrog's red flags are worth stealing: no mention on the maintainer's official security page, no linked commit or PR in the references, empty CPE product definitions, cited functions that don't exist in the target version.
The 2026 security story keeps circling one theme: agents attacking, agents defending, and now the defenders' own database getting poisoned. The uncomfortable conclusion is that any pipeline accepting plausible-looking text at scale is now an attack surface, and "validate before you trust" just became a job description.
Write-up: https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/
Comments