SQLite 'Critical' CVEs Were LLM Slop, JFrog Finds
JFrog researchers say a batch of SQLite advisories flagged as critical by NVD and CISA appear to be AI-generated 'LLM slop' with non-working PoCs and non-existent code references.
BY FOUNDERBUILT AI NEWS
JFrog security researchers say a batch of SQLite vulnerability advisories flagged as critical by NVD and CISA appear to be AI-generated LLM slop. A newly created GitHub repo, programmervuln/cveadvisory, published the advisories alongside more than 50 other CVEs that JFrog believes were also generated by AI. When researchers dug in to verify the claims, the reports fell apart.
The cited code did not exist in those versions, and the PoC payloads did not trigger any crash when run against official SQLite builds under AddressSanitizer. None of the CVEs appear on SQLite's official advisory page. Testing the advisories with GPTZero triggered AI-generated content warnings. One example: CVE-2026-51302, which Red Hat initially scored 10.0 Critical, has since been downgraded to 7.6 High.
JFrog's analysis matrix shows advisories citing non-existent functions, contradictory metadata, and lines unrelated to the alleged vulnerabilities. The case raises questions about the reliability of the CVE pipeline as AI-generated content floods vulnerability databases. JFrog recommends checking CVE claims against official vendor advisories before treating them as real threats.