One can hope that will put pressure on the industry to design a better system than CVEs. The signal noise ratio was already terrible before LLMs, I cannot imagine that will still be a meaningful system in 10y.

But I’m too cynical to not consider all the middlemen who benefit from the status quo

I'm very curious what organisations would have such a policy. I can't imagine it being viable for any size of org without significant self-deception (or banning the use of all open source at which point CVEs are moot anyway).

This was my first thought, this could be terrible if used offensively.

The best defense I can imagine is to have an agent reproduce the issues before a human sees it, but even that will cost money.

Steps to patch a hallucinated CVE:

   git stash -m "sigh"
   git commit --allow-empty -m "Patch: CVE-2026-51302"
   git stash pop

It’s honestly not great. The security guys are completely exasperated at my job, we’re wasting time having with these. You take the scam really, investigate for a bit, write up a DNF with justification, they go and up date records, and we all just kinda hope that someone updates the scans so it stops showing up.

Something is going to give, and I suspect that the optimistic open filling is going to get canceled.

Those organizations will have to adapt to new reality, ie, that some CVEs are not real.

All organisations also have exceptions to policies. This one would be one

Not really. LLMs can hallucinate the patches too :-)

Create the referenced but non-existent file and then fix it /s