Published CVEs seems a bad metric to use for this- unless we assume that the ratio of really nasty vulns/not-too-bad vulns is consistent.
replyAlso the question remains if more CVE laden code was produced in the first place, instead of automated detection improvements.
replyIt's easier to find a needle in the haystack if the haystack is 50% needles.
have the AI vibe code crappy apps so the related AI vuln finder can fix them
replyjust doubled the value and use cases of your AI solution!
Another reason published CVEs isn't a great metric is that one of the largest contributors to the number of CVEs significantly increasing in the past couple years has been that the Linux kernel now submits almost all bugs as CVEs which wasn't the case before.
replyI wouldn't look at the numbers. There used to be a lot of "scam" CVEs before LLMs, that weren't actual vulns. Nowadays its more popular to collect CVEs, and there is a lot of people scanning with LLMs and reporting without checking (like it was in case of cURL). These CVEs are often not verified by anyone.
replyThere probably is more vulnerabilities found, but the amount of CVEs is not a good metric.
Did you publish this anywhere? Would love to read more.
replyThe rules around CVE reporting changed recently and it would be expected a lot more are accepted.
reply