> All advisories in this repo seem AI generated when testing them with Gptzero

I pasted this blog post from "Analysis Matrix" to the end in Gptzero, and it also says the blog post was AI-generated (71% chance of AI, 29% chance of AI-Human mix).

So a so-called vulnerability has:

- cited code not exist, and

- PoC not work.

How would any serious system allow it become a big deal?

nonexistent functions being referenced is pretty bad, I haven’t had that issue since like opus 4. Shows either complete lack of oversight and/or using a bargain basement model (so no even having financial skin in the game). Most likely both

> Over the past few days, a newly created GitHub repo (programmervuln/cveadvisory-) published a batch of SQLite vulnerability advisories (as part of other 50+ CVEs which we believe are also LLM slop except from one). NVD quickly flagged these as critical, and CISA's ADP agreed.

These two sentences seem incompatible to me. A brand new actor can just say some stuff and cause major disruptions in this way?

Thankfully I’m seeing other people mention that this article itself seems AI-generated. While there's less proof, i suspect that the actual analysis was done by an llm as well. So while i like to dunk on hallucinations as much as the next guy, who's to say this analysis doesnt have them too?

(for the record, i think the cve's are probably bogus, i just think there's an inherent problem with debunking slop with slop)

could this be used to create some panic and make some money through trading or something?

no idea who submitted all of those, but it sounds like malicious intent

Taking security theatre to a whole new level.

Great article!

We need to further emphasize the importance of responsibility when using LLM tools to produce output for others. It's great to use them for refactoring and bug discovery, but keep in mind that it's your responsibility to analyze it and iterate on it with AI. It makes your code better and develops technical expertise.

The "Hey, analyze that codebase, find all dangerous CVEs, and write a README for the PoCs, so I can post it online for others to analyze, and if I'm lucky, I'll get a paycheck or a title to add to my resumé" approach might work in 0.1% of cases, but it will generate a ton of slop for the community to drown in.

I also think GPTZero and other AI detectors have far more false positives than correct guesses. I tried it on several texts & messages I wrote before 2019, and it flagged them as 80% AI-generated.

In that case, it's reasonable to assume that AI also generated the README text for each discovered CVE. In other cases, however, we should be more cautious.

just ran this article that ran a cve through gptzero.. through gptzero

-GPTZero AI Detection

-Model 4.8b

-We are moderately confident this text is a mix of AI and human

-63/88 Sentences likely AI generated

Wild catch. This highlights just how critical precise dependency vetting is for core database engines."