--- title: The Impact of AI on CVEs: Industry Challenges | daily.dev description: AI is flooding the CVE ecosystem with both real findings and fabricated 'slop', straining maintainers and institutions like NVD. Curl ended its bug bounty... canonical: https://daily.dev/posts/the-impact-of-ai-on-cves-industry-challenges-kzdruisi3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Impact of AI on CVEs: Industry Challenges | daily.dev og:description: AI is flooding the CVE ecosystem with both real findings and fabricated 'slop', straining maintainers and institutions like NVD. Curl ended its bug bounty... og:url: https://daily.dev/posts/the-impact-of-ai-on-cves-industry-challenges-kzdruisi3 og:image: https://api.daily.dev/og/posts/kzDruISI3.png og:image:alt: The Impact of AI on CVEs: Industry Challenges og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Impact of AI on CVEs: Industry Challenges **[JFrog](https://daily.dev/sources/jfrog)** · 10 min read · 0 upvotes · 0 comments ## Summary AI is flooding the CVE ecosystem with both real findings and fabricated 'slop', straining maintainers and institutions like NVD. Curl ended its bug bounty after AI-generated submissions pushed the confirmed-vulnerability rate below 5%. GNOME cut its disclosure window from 90 to 30 days due to AI-generated reports. A newly created GitHub account published 55 SQLite security advisories, 54 of which were completely fabricated, with the technical details appearing to have been hallucinated by an LLM, some citing nonexistent functions and impossible line numbers. Oracle's July 2026 patch update fixed 1,434 CVEs, and Verizon data shows only 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38%, with median fix time rising to 43 days. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### why did curl shut down its bug bounty program Curl creator Daniel Stenberg ended the project's bug bounty program after an explosion of AI-generated submissions in 2025 flooded the system with invalid reports. The share of submissions confirmed as real vulnerabilities fell below 5%, making the program unsustainable for maintainers to triage. _Developers tracking maintainer burnout from AI slop can follow curl's story and similar cases on daily.dev._ ### what happened with the fake SQLite security advisories in 2026 A newly created GitHub account published over 50 security advisories against SQLite and other open-source projects, and JFrog found 54 of 55 were completely fabricated by an LLM. The reports cited nonexistent functions like exprComputeOperands(), impossible line numbers, and fake fixes, yet several still received CVSS scores up to 9.8 Critical and were accepted by CISA's ADP program. _Anyone vetting incoming CVE feeds for AI slop can dig into this case study on daily.dev._ ### why did GNOME shorten its security disclosure deadline to 30 days GNOME's security coordinator Michael Catanzaro cut the vulnerability disclosure deadline from 90 days to 30 for reports filed on or after August 1, 2026, because the overwhelming majority of incoming reports used LLMs and often contained AI-generated material. He also stopped forwarding AI-generated reports to maintainers who opted out of receiving them. _Maintainers rethinking disclosure policy under AI-driven report volume can track changes like this on daily.dev._ ## Similar posts on daily.dev - [Did AI Just Break Software Security For Ever?](https://daily.dev/posts/did-ai-just-break-software-security-for-ever--6pxwdikky) · Foojay.io · 0 upvotes · 0 comments - [The Vulnerability Curve Bent With the AI Curve — ProjectDiscovery Blog](https://daily.dev/posts/the-vulnerability-curve-bent-with-the-ai-curve-projectdiscovery-blog-6crwmllob) · ProjectDiscovery Blog · 0 upvotes · 0 comments - [Analyzing the vulnerability landscape in Q2 2026](https://daily.dev/posts/analyzing-the-vulnerability-landscape-in-q2-2026-mknnem6b6) · Securelist · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/the-impact-of-ai-on-cves-industry-challenges-kzdruisi3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Impact of AI on CVEs: Industry Challenges","url":"https://daily.dev/posts/the-impact-of-ai-on-cves-industry-challenges-kzdruisi3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-impact-of-ai-on-cves-industry-challenges-kzdruisi3"},"datePublished":"2026-10-28T14:31:42.108Z","dateModified":"2026-10-28T14:58:11.373Z","description":"AI is flooding the CVE ecosystem with both real findings and fabricated 'slop', straining maintainers and institutions like NVD. Curl ended its bug bounty...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d14e47d19f9aa7c6f8b9dc1a16b956a6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d14e47d19f9aa7c6f8b9dc1a16b956a6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"JFrog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"JFrog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/b11bf37102384ac9983be701b2cf7cd5","url":"https://daily.dev/sources/jfrog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-impact-of-ai-on-cves-industry-challenges-kzdruisi3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,appsec","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"JFrog","item":"https://daily.dev/sources/jfrog"},{"@type":"ListItem","position":3,"name":"The Impact of AI on CVEs: Industry Challenges"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-impact-of-ai-on-cves-industry-challenges-kzdruisi3#faq","mainEntity":[{"@type":"Question","name":"why did curl shut down its bug bounty program","acceptedAnswer":{"@type":"Answer","text":"Curl creator Daniel Stenberg ended the project's bug bounty program after an explosion of AI-generated submissions in 2025 flooded the system with invalid reports. The share of submissions confirmed as real vulnerabilities fell below 5%, making the program unsustainable for maintainers to triage. Developers tracking maintainer burnout from AI slop can follow curl's story and similar cases on daily.dev."}},{"@type":"Question","name":"what happened with the fake SQLite security advisories in 2026","acceptedAnswer":{"@type":"Answer","text":"A newly created GitHub account published over 50 security advisories against SQLite and other open-source projects, and JFrog found 54 of 55 were completely fabricated by an LLM. The reports cited nonexistent functions like exprComputeOperands(), impossible line numbers, and fake fixes, yet several still received CVSS scores up to 9.8 Critical and were accepted by CISA's ADP program. Anyone vetting incoming CVE feeds for AI slop can dig into this case study on daily.dev."}},{"@type":"Question","name":"why did GNOME shorten its security disclosure deadline to 30 days","acceptedAnswer":{"@type":"Answer","text":"GNOME's security coordinator Michael Catanzaro cut the vulnerability disclosure deadline from 90 days to 30 for reports filed on or after August 1, 2026, because the overwhelming majority of incoming reports used LLMs and often contained AI-generated material. He also stopped forwarding AI-generated reports to maintainers who opted out of receiving them. Maintainers rethinking disclosure policy under AI-driven report volume can track changes like this on daily.dev."}}]} ```