Get the app

Fake CVEs, AI-Generated Reports and the Need for Verification

Unite.AI
Read full story· 6 min
In July 2026, six CVEs reported against SQLite were found to be invalid after investigation revealed nonexistent functions and unreplicable exploits. The surge in AI-generated vulnerability reports, exemplified by a 10-fold increase in CVE submissions to GitHub's CNA, is overwhelming security teams and complicating verification processes. This trend highlights the growing challenge of distinguishing genuine vulnerabilities from unverified or erroneous AI-generated claims.

What happened

In July 2026, six security vulnerabilities (CVEs) reported against the SQLite database were investigated and found to be invalid. The reports described severe memory-safety issues and included technical details, but researchers discovered that some referenced functions did not exist and the exploits could not be reproduced. These CVEs were later rejected and removed from SQLite’s official records. The incident occurred amid a sharp rise in AI-generated vulnerability reports, which are making it harder for security teams to verify claims.

Key details

  • Two of the six SQLite CVEs received a severity score of 9.8.
  • GitHub’s CVE Numbering Authority received nearly 4,000 CVE requests in May 2026.
  • This represents a tenfold increase in submissions compared to the previous year.
  • About 20% of incoming security reports for curl in 2025 were estimated to be AI-generated.
  • Rejected CVEs can still circulate in security feeds and databases after being disproven.

Why it matters

Software maintainers and security teams must now spend more time and resources verifying vulnerability reports, increasing their workload and operational costs. The surge in AI-generated, unverified claims can lead to reputational harm for projects and companies, as false vulnerabilities may be widely publicized before being corrected. This also raises the risk that genuine security issues could be overlooked or delayed while teams investigate erroneous reports.

#github#jfrog#software-security#sqlite#vulnerability-disclosure

More in Cybersecurity