AI slop pollutes the CVE pipeline with fake vulns

The CVE program is drowning in AI-generated sludge. Over the past six months, vulnerability coordination centers at MITRE, GitHub Security Lab, and major vendor security response teams have watched the incoming queue swell with submissions that bear the unmistakable fingerprints of large language models: formulaic prose, hallucinated code paths, and impact assessments that don't match the cited component versions.

The floodgates open

The catalyst was predictable. Once researchers demonstrated that LLMs could automate vulnerability discovery in open-source codebases, the incentive structure flipped. Bug bounty hunters, academic groups chasing publication counts, and reputation farmers on platforms like HackerOne and Bugcrowd realized they could generate fifty plausible-sounding reports in the time it took to validate one. The CVE Numbering Authorities — MITRE as primary CNA, plus GitHub, Microsoft, Oracle, and a dozen others — became the intake valve for this deluge.

MITRE's own telemetry shows the shift. In Q4 2024, the organization processed approximately 28,000 CVE assignments. By Q2 2025, that figure crossed 41,000 — a 46 percent jump with no corresponding increase in confirmed exploitable vulnerabilities. The rejection rate for "insufficient evidence" or "duplicate" classifications climbed from 12 percent to 31 percent in the same window.

Anatomy of a fake

The tells are consistent. LLM-crafted submissions typically lead with a verbose executive summary, then cite a generic attack vector — "improper input validation in the authentication module" — without anchoring it to a specific function, file, or commit hash. Proof-of-concept snippets, when present, reference imports that don't exist in the target repository or invoke methods with signatures that changed three major versions ago.

GitHub Security Lab engineers describe a recurring pattern: the reporter opens a private vulnerability advisory on a popular repository, attaches a polished Markdown write-up, and includes a diff that "fixes" the issue by adding a null check to a function that already validates its parameters. When maintainers push back, the reporter either goes silent or produces a second LLM-generated response insisting the vulnerability is "theoretically exploitable under specific memory layout conditions."

Prompt injection as force multiplier

The Google A2A (agent-to-agent) research released this spring demonstrated how prompt injection can chain autonomous coding agents into recursive vulnerability hunting loops. One agent proposes a flaw; a second validates it against a hallucinated threat model; a third writes the advisory. The resultant artifacts pass superficial syntactic checks but collapse under semantic review.

This isn't theoretical. In March, a coordinated spike of 340 CVE requests across 12 NPM packages traced back to a single GitHub Actions workflow that orchestrated three LLM prompts: enumerate entry points, hypothesize bypasses, format for CVE submission. The workflow ran nightly for two weeks before GitHub's abuse detection flagged the pattern. By then, 47 CVEs had been assigned — 43 later rejected.

Vendors pay the tax

The cost lands on vendor security teams. Microsoft's MSRC, Red Hat Product Security, and the Android Security Team each maintain dedicated triage pods for CVE intake. A senior engineer at Red Hat estimated that each false positive consumes 3.2 analyst-hours: ingestion, reproduction attempt, reporter communication, and closure documentation. At current volumes, that's roughly 1,800 engineer-hours per quarter across the top ten vendors — equivalent to nine full-time senior security engineers doing nothing but cleaning up AI exhaust.

Oracle's August security bulletin explicitly called out the trend: "We observe a marked increase in CVE assignments where the reported vulnerability cannot be reproduced against any supported version. Requesters increasingly cite AI-assisted discovery methodologies without providing reproducible artifacts."

The CNA bottleneck

MITRE, as the primary CNA, bears the sharpest edge. Its assignment pipeline — historically a lightweight web form with human review — now requires automated pre-filters. The organization deployed a classifier in May that scores submissions on specificity markers: presence of git commit hashes, version-pinned dependency trees, minimal reproduction steps. Submissions scoring below threshold route to a delayed queue with a 21-day SLA instead of the standard 72 hours.

The classifier helps but creates a new failure mode. Legitimate researchers unfamiliar with the new heuristics — particularly those reporting logic flaws in business applications rather than memory corruption in C libraries — find their valid reports delayed. Two independent security consultancies confirmed they've adjusted their disclosure workflows to include "classifier optimization" steps: embedding specific keywords and structural elements to pass the automated gate.

Reputation systems adapt

HackerOne and Bugcrowd have responded with reputation penalties. HackerOne's July policy update introduced a "synthetic submission" flag: if three of a researcher's last ten submissions are rejected as AI-generated without valid reproduction, their program access downgrades to "invite-only" for 90 days. Bugcrowd took a harder line — any submission flagged by two independent triagers as LLM-fabricated triggers an account review and potential permanent suspension.

Early data suggests the deterrent works. HackerOne reported a 22 percent drop in new researcher registrations in August versus July, but a 38 percent drop in invalid submissions per active researcher. The platform's chief security officer characterized it as "quality over quantity self-selection."

Where the pipeline goes next

Three structural changes are emerging. First, CVE Numbering Authorities are moving toward mandatory reproduction artifacts — container images, VM snapshots, or CI pipelines that demonstrate the flaw — before assignment. GitHub Security Lab piloted this for its own CNA scope in June; MITRE is evaluating for Q4 rollout.

Second, the CVE record format itself may expand. The current JSON schema captures description, references, and CVSS vectors. A proposed extension adds "reproduction_uri," "validator_attestation," and "generation_method" fields — the last explicitly declaring whether AI assistance was used and, if so, which model and prompt architecture.

Third, vendors are banding together on a shared triage ledger. The OpenSSF Vulnerability Disclosure Working Group — now counting Microsoft, Google, Amazon, Red Hat, and SUSE as active participants — is prototyping a federated validation layer. When one member validates or rejects a CVE candidate, the attestation propagates to others, avoiding duplicate analysis. The ledger uses cryptographic signatures tied to each organization's SSDF-compliant identity.

The signal remains

None of this dismisses AI-assisted vulnerability research. The same LLMs polluting the intake valve also power legitimate finds: the cursor-to-cursor buffer overflow in libvte (CVE-2025-3241) was first hypothesized by a researcher using a fine-tuned CodeLlama variant, then manually verified and minimized to a 17-line reproducer. The difference is discipline — the researcher treated the model as a hypothesis generator, not an authority.

The CVE program survives on signal-to-noise. Right now, the noise is winning. The fixes are structural, not cosmetic. They require changing what counts as a vulnerability report, who bears the burden of proof, and how the ecosystem distinguishes a security contribution from a content farm harvest. The pipeline will clear — but only when the cost of flooding it exceeds the reward.