AI is generating fake CVEs - and they're making it into real vulnerability databases

A US firm confirmed that AI-hallucinated vulnerability entries for SQLite are passing initial triage and landing in real security reporting pipelines. It's a new attack surface no one designed for.

In plain terms: AI tools are inventing security vulnerabilities that don't exist in real code - and some of those fabricated entries are ending up in the databases security teams use to decide what to patch.

The fact

A US security firm analyzed AI-generated CVE entries targeting SQLite and confirmed that hallucinated vulnerabilities pass initial triage in some automated pipelines and enter real security reporting systems, according to ITmedia AI+. The entries describe bugs absent from SQLite's actual codebase. CVE stands for Common Vulnerabilities and Exposures - the global index that security tools, scanners, and patch managers depend on.

Our take

This is the supply-chain version of AI hallucination, and the consequences scale differently from a chatbot making something up. The NVD (National Vulnerability Database) is already backlogged - it has struggled to process legitimate submissions for years. Fake entries don't just waste analyst time: they generate false positives for automated scanners, potentially crowding out real vulnerabilities in prioritization queues. Any security workflow that ingests CVE feeds without human validation now carries structural risk. The fix isn't straightforward - CVE reporting is semi-automated by design, and retrofitting an AI-origin flag requires coordination between MITRE, NIST, and hundreds of downstream vendors.

What to watch

Whether MITRE updates submission policies to require provenance disclosure, and whether major security platforms start flagging AI-assisted CVE entries in their feeds.