The software industry runs on a shared list of known bugs. Someone is now seeding that list with breakage that no one ever found.
Security firm JFrog found six critical SQLite flaws that were pure fiction, it reported. The advisories claimed severe memory bugs with scores up to 9.8. But the functions they blamed did not exist in the versions cited, and the proof-of-concept code ran without a crash. Fed through the detector GPTZero, the write-ups came back as machine-generated. They were AI slop.
And not just six. One new GitHub account posted 55 vulnerability reports in a matter of days, and JFrog found 54 fabrications. Only one held a real bug, wrapped in bogus metadata.
The rest invented holes in SQLite, the image library libraw and an Arduino audio decoder. Red Hat briefly rated one SQLite entry a perfect 10.0, then lowered it to 7.6. SQLite added the function it blamed in 2025, a year after the version it supposedly broke.
How fiction became official
