LLM-fabricated leak enters CVE database, prompting NCSC to withdraw warning
The NCSC has withdrawn a warning for an alleged SQLite vulnerability (CVE-2026-51302) after it appeared that the bug was likely hallucinated by an LLM. Security researchers, SQLite developers, and Red Hat were unable to reproduce the vulnerability and have labeled it as fictitious.
Notably, MITRE accepted the CVE despite a lack of sufficient verification, leading the NCSC to initially adopt the report as well. The case raises serious questions about the reliability of the CVE registration process and the risks of AI-generated vulnerability reports. This incident underscores that in cybersecurity, AI output must always be independently validated before being used as a reliable source.
Read the Tweakers.net article for more information.