The rise of generative AI has ushered in a disturbing new trend: the manufacturing of “ghost” vulnerabilities that don’t actually exist. Recently, a cache of high-severity vulnerabilities linked to the widely used SQLite database appeared in the National Vulnerability Database (NVD), accompanied by official-looking enrichment from CISA. However, security researchers at JFrog quickly exposed these entries as entirely fabricated. When experts dug into the claims—some of which carried alarming “Critical” CVSS scores of 9.8—they found nothing but digital noise. The alleged flaws cited functions that didn’t exist, pointed to irrelevant lines of code, and failed to produce even a single memory leak during testing. This wasn’t just a minor technical error; it was a sophisticated, AI-generated mirage designed to look like a legitimate security threat.
The reach of this “poisoning” went far beyond just SQLite. In total, 54 bogus CVEs (Common Vulnerabilities and Exposures) were traced back to an obscure GitHub repository, covering various open-source libraries like libraw and ESP32-audioI2S. While security teams initially scrambled to address these supposed “zero-day” exploits, it became clear that the reports were hollow. Even as MITRE moved to reject the batch, the incident served as a wake-up call for the cybersecurity industry. It highlighted a dangerous, systemic flaw: the entire vulnerability disclosure infrastructure relies heavily on an honor system that assumes those submitting bug reports have done their due diligence. As Oracle Solaris engineer Alan Coopersmith noted, the agencies responsible for cataloging these issues simply don’t have the resources to verify every single claim themselves.
This crisis of confidence is being exacerbated by a significant breakdown in the NVD’s processing capabilities. Historically, the National Institute of Standards and Technology (NIST) acted as a reliable gatekeeper, manually reviewing and enriching vulnerability data before it reached the public. However, that safety net has essentially collapsed under the weight of an overwhelming surge in submissions. A massive backlog, which grew to over 27,000 unresolved records by 2025, has left the system vulnerable to exploitation. Recent government reports suggest that a lack of strategic planning has rendered these attempts to clear the backlog ineffective. When the gatekeepers are overwhelmed, the automated pipelines that funnel this data into enterprise security scanners become a “garbage in, garbage out” nightmare.
The core problem is an increasing asymmetry in the digital arms race. AI has lowered the cost of creating a “plausible-sounding” security report to almost zero, while the labor-intensive process of verifying code, testing patches, and reproducing proofs-of-concept remains as grueling and time-consuming as it has always been. As JFrog’s researcher Afek Berger warned, this imbalance is unsustainable. When security professionals are flooded with fake reports, they inevitably lose time that should be spent on genuine threats. By the time a defender realizes a high-severity alert is actually just an AI hallucination, they have already wasted precious cycles that could have been used to patch real, active vulnerabilities.
To navigate this new landscape, organizations must adopt a “trust but verify” mindset that prioritizes corroboration. JFrog suggests that defenders shouldn’t take a new CVE at face value if the software vendor itself—in this case, the SQLite maintainers—hasn’t acknowledged the issue. Furthermore, security teams should be highly suspicious of reports that lack clear commit hashes, verified pull requests, or logically sound code references. If the documentation feels “off” or the metadata is incomplete, it is a hallmark of modern AI-generated slop. While the specific fake entries mentioned in this incident have been flagged or removed, the repository remains an open wound, and the ease with which these fakes infiltrated the ecosystem proves that bad actors—or simply misguided ones—have found a new way to disrupt our defenses.
Looking ahead, this incident is likely a harbinger of a broader, more persistent challenge. Whether the motivation behind these fake vulnerabilities is a misguided attempt to boost a researcher’s profile or a malicious effort to trick automated security tools, the outcome is the same: the pollution of our critical infrastructure data. The cybersecurity industry is currently forced to reckon with the fact that AI-driven “noise” is becoming indistinguishable from genuine intelligence. Without a significant shift toward mandatory, automated proof-of-concept requirements and a more robust verification process for vulnerability ingestion, the industry will continue to be haunted by these artificial specters, forced to fight shadows instead of real threats.