54 of 55 AI-Found SQLite Flaws Were Fake, Yet Slipped into NVD

A recent security sweep marketed as an automated breakthrough delivered almost nothing but noise. According to an audit by cybersecurity firm JFrog, 54 out of 55 vulnerabilities allegedly discovered by artificial intelligence in the SQLite database engine were completely bogus.

All three reports flagged as critical severity turned out to be hallucinations. The single legitimate issue identified in the batch was not critical and was submitted alongside unverified metadata. Although MITRE subsequently rejected the batch, the entries had already propagated into the United States National Vulnerability Database (NVD).

The tainted records have since been removed from standard NVD search queries, though they remain archived with a "Rejected" status assigned by the reporting CVE Numbering Authority. Their initial acceptance stems from systemic strain: the National Institute of Standards and Technology (NIST), which oversees the NVD, stopped manually verifying every submission after accumulating a backlog exceeding 17,000 unanalyzed entries in 2024.

With automated scanners increasingly churning out unvetted vulnerability reports, the pipeline relies on triage mechanisms that are already running without routine human review.

Source: habr

Details: JFrog Research