Hallucinated CVE poisons the security vulnerability pipeline

A CVE was formally issued for a vulnerability in SQLite that does not exist. An LLM hallucinated it, someone filed it, and it made it through the process. The thread on Hacker News quickly identified the cascading problem: organizations with mandatory CVE patching policies now have to chase a ghost, and the legitimate CVE signal is getting diluted by AI-generated noise.

The pattern here is ugly. CVE databases are a trust layer that the entire security industry depends on. If LLMs are now generating plausible-sounding but fake vulnerability reports at scale, the cost of operating that trust layer goes up dramatically. Every real CVE now has to compete with synthetic ones for attention, which means real vulnerabilities get slower responses.

Commenters noted a dark irony: LLMs are also being used to triage and summarize CVEs, which means AI-generated fake vulnerabilities could loop back through AI-powered security tools and get treated as real. The compounding error problem is not theoretical.