AI Slop CVEs may be worse than the slopsploits we see being slung across the internet.
JFrog audited 55 advisories from 1 new GH acct. 54 were fabricated. The SQLite ones cite UAFs in functions that didn't exist, line numbers past EOF, & PoCs that die at the parser. NVD scored several 9.8 Critical anyway. 🤷🏽♀️
Since NVD paused deep analysis in 2024, nothing in the pipeline requires a repro. Plausible prose is enough to reach your scanner.
https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/
hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪 4
npub1u9…nuwwf
2026-08-03 11:53:37 UTC
Author Public Key
npub1u99vm8p87l3n8h2wm9zs592sr28jud5t9r7xkzq4dwyze0p30j0scnuwwfSeen on
wss://relay.ditto.pubPublished at
2026-08-03 11:53:37 UTCEvent JSON
{
"id": "7ca6ad748fe3e12479621467f25ce25fa41dc499a4324cbbe19d5b12307593b6",
"pubkey": "e14acd9c27f7e333dd4ed9450a15501a8f2e368b28fc6b08156b882cbc317c9f",
"created_at": 1785758017,
"kind": 1,
"tags": [
[
"proxy",
"https://mastodon.social/users/hrbrmstr/statuses/117031437443260919",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "AI Slop CVEs may be worse than the slopsploits we see being slung across the internet.\n\nJFrog audited 55 advisories from 1 new GH acct. 54 were fabricated. The SQLite ones cite UAFs in functions that didn't exist, line numbers past EOF, \u0026 PoCs that die at the parser. NVD scored several 9.8 Critical anyway. 🤷🏽♀️\n\nSince NVD paused deep analysis in 2024, nothing in the pipeline requires a repro. Plausible prose is enough to reach your scanner.\n\nhttps://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/",
"sig": "79308779a58885a5d2c0de243ced9d6aed00e2051da38e4f02f237068377e18eeeb8a66979c6425c3037280f8825c1ea4740203a6cb0a8cde875f0d569e7ee85"
}