JFrog: AI Is Flooding the CVE System With Noise and Fabricated Advisories

A surge in CVEs and a burden on maintainers

JFrog argues that generative AI has removed the deep technical expertise that once limited how many vulnerabilities were discovered and verified. Experienced researchers can now find complex zero-days faster, the company says, while less skilled researchers use AI to produce a stream of low-effort reports. JFrog's security research team collected data on CVEs published since 2021 and reports a steady climb in volume, which it attributes to those two AI-related trends.

The effects are visible in open-source projects. In January 2026, Daniel Stenberg, creator of the curl utility, announced the end of the project's bug bounty program. According to Stenberg, an explosion of AI-generated submissions in 2025 led to a flood of invalid reports, and the share confirmed as vulnerabilities fell below 5%.

Months later, Michael Catanzaro, then the security coordinator for the GNOME project, announced he would no longer forward security reports to GNOME maintainers who had opted out of AI-generated content. He said the overwhelming majority of incoming reports in 2026 used LLMs. He also cut GNOME's disclosure deadline from 90 days to 30 for issues reported on or after August 1, 2026. JFrog notes that some projects, notably the Linux kernel, have adopted immediate full disclosure for reports that seem AI-generated.

NVD narrows its focus as exploits get easier to build

The volume has also forced changes at NIST. In an April 2026 announcement on NVD operations, NIST said that from April 15, 2026 it would prioritize CVEs in CISA's Known Exploited Vulnerabilities Catalog, software used by the federal government, and critical software. Backlogged CVEs published before March 1, 2026 were moved to "Not Scheduled." In JFrog's view, this leaves many CVEs without NVD enrichment and shifts more verification work onto enterprise security teams.

JFrog also says AI shortens the path from disclosure to exploitation. In a May 2026 case involving CVE-2026-46529, which affects GNOME's Evince document viewer and its forks, a researcher used Claude to help develop a weaponized, single-click code-execution exploit. The company adds that controlled research from PoCGen and Anthropic has shown similar capabilities.

Severity inflation and the libcurl case

JFrog describes severity inflation as a rating based on a theoretical worst case without enough regard for the conditions needed to trigger it, such as exposed code, an enabled optional feature or a specific configuration. It points to the FIRST CVSS v4.0 User Guide, which states that Base scores measure severity and should not be used alone to assess risk. Scanners, dashboards and remediation policies often treat them as a universal measure of urgency anyway, according to JFrog.

The company says scoring at scale makes this worse, because a careful score can require reviewing code, reproducing the issue, inspecting the fix and understanding deployment. Under volume pressure, assessors may fall back on short descriptions or worst-case defaults.

As an example, JFrog cites libcurl. Since June, maintainers have published 27 CVEs with assessed impacts from Low to Medium, but when CISA evaluated them, nearly all were escalated to High or Critical. JFrog's researchers found that some Critical scores applied to client-side crashes or niche client configurations outside an attacker's control. In its assessment, several client-side use-after-free bugs were miscategorized as network-based memory corruption threats.

Fabricated advisories reach downstream feeds

JFrog also describes AI-generated "slop" advisories that mimic the tone and formatting of real ones. In research it published in July 2026, a newly created GitHub repository released over 50 security advisories targeting SQLite and other open-source projects. They described Use After Free flaws and received CVSS scores up to 9.8 Critical, and CISA's ADP program agreed, according to JFrog.

When JFrog checked the code, the reports fell apart. The advisories cited functions such as exprComputeOperands() and jsonBlobEdit() that were not in the targeted SQLite versions. One pointed to line 3555 in a file with only 2706 lines. Another claimed a fix that source diffs did not show. Of 55 advisories from that account, JFrog says 54 were completely fabricated.

What it means for security teams

JFrog's central point is that the CVE pipeline does not require a working proof of concept before scores are issued, so fabricated or inflated reports can flow into GHSA, enterprise scanners and developer alerts. For security teams, that means Base scores alone are a weak guide to priority. JFrog says it offers its own research-backed severity assessments so customers can set policies on JFrog severity scores rather than relying solely on external Base scores. This is the first part of a series, and the source text ends as it begins a section on the cost of keeping up.