{
  "id": 101352,
  "title": "AI slop pollutes the CVE pipeline with fake vulns",
  "url": "https://urgent.news/2026/08/03/ai-slop-pollutes-the-cve-pipeline-with-fake-vulns-101352",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-03T17:19:36.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/08/03/ai-slop-pollutes-the-cve-pipeline-with-fake-vulns/5282462"
  },
  "original_language": "en",
  "account": "AI-generated fake vulnerabilities have infiltrated the CVE pipeline, posing a threat to software supply chains. Six SQLite vulnerabilities, initially listed with high CVSS scores, turned out to be bogus upon testing. JFrog, a software supply chain security company, discovered these vulnerabilities after running them through an AI checker. The CVSS scores ranged from 9.8 to 7.5, but none of the six advisories described a reproducible vulnerability. Another 54 fake CVEs were found in a GitHub repository, claiming security vulnerabilities in open-source libraries like RAW image processing library libraw and Arduino audio decoding library ESP32-audioI2S. Experts warn that the lack of mandatory checkpoints in the current system allows fake advisories to slip through undetected. Defenders are advised to verify the legitimacy of new CVEs by checking vendor confirmation, references to commits or pull requests, and suspicious metadata before acting on them.",
  "summary": "With NIST still buried under its backlog, expect AI-generated bogus reports to continue",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register",
        "title": "AI slop pollutes the CVE pipeline with fake vulns",
        "url": "https://urgent.news/2026/08/03/ai-slop-pollutes-the-cve-pipeline-with-fake-vulns",
        "published": "2026-08-03T17:19:36.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}