Treat CVE feeds as untrusted input once LLM slop enters the vulnerability…

Treat CVE feeds as untrusted input once LLM slop enters the vulnerability pipeline. The SQLite false-alarm episode shows how plausible-sounding, AI-generated advisories can get a critical score and then cascade into tickets, bot actions, and emergency work that wastes engineering time. Add a simple evidence threshold: vendor corroboration, commit hashes, working PoC, and a source-trust tier before your triage bots open tickets or block releases. That constraint buys you fewer false alarms and keeps automation from turning imagination into outages.