The Dutch National Cyber Security Centre spent five days telling organizations to worry about a bug that never existed. On July 29 the NCSC published advisory NCSC-2026-0268, warning about CVE-2026-51302, a memory corruption flaw in SQLite 3.41 that carried a severity rating as high as 10 out of 10. On Monday the agency withdrew the advisory with a single added line, saying the CVE has been retracted and the vulnerability was very likely hallucinated by a large language model.
The unraveling is documented by JFrog's security research team, which traced the CVE back to a GitHub account named programmervuln that had published 55 SQLite vulnerability advisories. JFrog's audit found that 54 were completely fabricated and one contained a real bug wrapped in unverified CVE metadata. The fabrications were not subtle once someone actually looked. Functions cited in the advisories do not exist in the SQLite versions named, referenced line numbers point past the end of the files, the proof of concept payloads crashed nothing when run under AddressSanitizer, and none of the CVEs appear on SQLite's own vulnerability page. The text itself triggered warnings from the AI detection tool GPTZero.
What matters is how far the fiction traveled before anyone checked. MITRE's public CVE submission form performs no real identity verification, so the account was able to obtain at least six CVE identifiers, with four rated critical or high, including two scored 9.8 and one 9.1. NIST scaled back manual analysis of submissions after a backlog surge in early 2024, which removed the layer that might once have caught this. From there the scores flowed automatically into the databases that vulnerability scanners, dependency checkers and national response teams consume. In the Netherlands the pipeline terminated in a government advisory telling organizations to patch.
SQLite is a worst case target for this kind of pollution because it is among the most widely deployed pieces of software in the world, embedded in browsers, phones, operating systems and countless applications. A critical score against it guarantees attention. JFrog's researchers put the cost plainly, writing that these LLM slop CVEs can cause organizations to waste time investigating and patching vulnerabilities that do not actually exist, as well as polluting vulnerability databases. That cost was paid in real hours, by security teams that triaged the alerts and by a national agency that issued a warning and then had to walk it back.
The retraction itself is the healthy part of the story, and the checks that finally caught the hoax, reading the source code, running the exploit, looking at the vendor's own security page, are exactly the ones the pipeline skipped on the way in. The asymmetry is the problem that remains. A language model can produce a convincing advisory in seconds, while disproving one took researchers hours of hands on verification per claim. The CVE system was built on the assumption that vulnerability reports are submitted in good faith, and that assumption now has to survive contact with tools that can manufacture confident, well formatted fiction at scale.