The IT security company JFrog has revealed that 54 out of 55 alleged security vulnerabilities in the SQLite database were completely fabricated – published through a single GitHub account within four days. Six of the reports initially reached critical values in official databases of up to 9.8 out of 10 points, even though the described functions did not exist in the actual SQLite source code.
Incorrect function names expose the AI origin
JFrog security researcher Afek Berger examined six advisories, all claiming use-after-free errors in SQLite – such as in the functions exprComputeOperands(), ExprListDelete(), and sqlite3ExprDelete().
The six reports carried the identifiers CVE-2026-51302, CVE-2026-51303, CVE-2026-51300, CVE-2026-51297, CVE-2026-51296, and CVE-2026-51304, with CVSS values between 7.5 and 9.8. To verify the claims, the team cloned the official SQLite source code, compiled the mentioned versions in isolated Docker containers with AddressSanitizer instrumentation, and executed the provided code examples verbatim.
None of the six errors could be triggered. In several reports, the advisories referred to line numbers that extended far beyond the end of the respective source file – in one case to line 3575 in a file with 2,706 lines.
Other reports mentioned functions that simply did not exist in the specified SQLite versions. A tool for detecting AI-generated texts additionally classified the wording of the advisories as machine-generated.
JFrog then expanded the review to all 55 reports from the same GitHub account: 54 turned out to be completely fabricated, and only one finding contained a real, albeit poorly documented, error.
Evaluation bodies initially assign maximum values
The fakes passed through the official CVE process before they were noticed. Red Hat initially assigned the report CVE-2026-51302 the maximum value of 10.0 out of 10 points and lowered it to 7.6 after JFrog's notification.
On the platform X, JFrog Security stated that the submitted evidence did not match the assigned critical rating. JFrog informed not only Red Hat but also the GitHub Security Advisory Database and the US vulnerability database NVD about the finding.
Who is behind the GitHub account and with what purpose the reports were published remains unverified independently. Similar patterns are not an isolated case: already in July, Apple restricted its bug bounty program after AI-generated reports had overwhelmed the review team, while independent data simultaneously showed a sudden increase in real, AI-discovered vulnerability reports at large technology companies.
According to JFrog, the CVE submission does not require identity verification, and the NVD has significantly reduced its manual review capacity since February 2024.
It will be crucial whether NVD and GHSA introduce stricter submission rules, such as a requirement for verifiable code examples or commit references – so far, neither of the two bodies requires such proof. Until such a reform occurs, security teams have no choice but to check each new critical report against the actual source code before patching.
