SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Developer accidentally discovers real CVE while testing AI bug-report verification tool

0
·1 views

A developer building a tool to verify claims in security bug reports used a deliberately fabricated CVE number, CVE-2026-45871, as a test case, only to find the tool flagged it as a real vulnerability. The CVE turned out to be an actual Linux kernel TPM bug, exposing a gap in the tool's detection logic. Every other fabricated claim in the same test report was correctly identified as false. The incident highlighted a broader problem: AI-generated bug reports can produce plausible-sounding but fictitious function names, file paths, and symbols that are difficult for maintainers to quickly verify. The developer has since open-sourced the verification tool under the Apache-2.0 license and is seeking feedback from open-source maintainers who regularly receive such reports.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Nyreth v1.0 Launches AI System That Converts Text Meaning Into Symbolic Image Files

Nyreth v1.0 is a newly released AI system designed to extract emotional and cognitive meaning from text in a way that is interpretable by both humans and machines. It uses a recursive symbolic reasoning process, a form of neurosymbolic AI, to produce structured and fully deterministic outputs. The system parses text and compresses its most significant meaning into a custom file format called a nyr tile, with the extension .nyr. These tiles encode meaning both visually and through rich metadata, making them usable by AI agents or human readers. The project is publicly documented on GitHub and the platform is accessible at nyreth.ai.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Pick an SMS API for App Alerts Using Bounce-Suppression Controls

Choosing an SMS API for B2B SaaS alerts should focus on how webhook and polling delivery events feed into a single, idempotent status ledger rather than on surface-level feature comparisons. Both data sources represent claims about the same message attempt and neither should directly modify a recipient suppression list. Engineers are advised to apply three controls: idempotent ingestion, a monotonic state policy that prevents late events from reversing terminal states, and a strict separation between attempt status and suppression decisions. Providers such as Twilio, Vonage, and AWS End User Messaging SMS should be evaluated against a documented contract test covering sender type, destination region, and event settings. A reliable status ledger should be append-only, ensuring operators retain the full event sequence needed for auditing and recovery.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Cuts AI Pipeline Delays by Routing Bulk Tasks to Local LLM on Mac Mini

A developer running automated QA scripts for video Shorts hit severe bottlenecks when cloud API rate limits slowed a two-minute job to four hours. The root cause was dozens of rapid requests overwhelming a free-tier cap of 5–10 requests per minute. Realizing their Mac Mini was already running 24/7 and sitting idle, they connected a local LLM at localhost:1234 directly into the pipeline at near-zero marginal cost. They adopted a hybrid fallback strategy: cloud APIs handle complex reasoning and long-context tasks, while the local Qwen model absorbs high-volume, repetitive workloads during rate-limit surges. The result was a stable, uninterrupted pipeline with no manual overrides and full privacy over draft scripts.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

WebMCP Challenge Opens: Experts Urge Developers to Expose Real Site Actions to AI Agents

The WebMCP Challenge, backed by OpenAI, Cloudflare, Shopify, Vercel, Render, and Netlify, runs from August 25 to September 3 on Devpost with $35,000 in prizes. The competition invites developers to build using WebMCP, a browser API that enables web pages to provide AI agents with callable tools instead of requiring them to navigate a traditional UI. Experienced builders warn that the most common mistake is wrapping a chat or search interface as a tool, since agents already serve as the conversational layer and instead need access to specific site actions like catalog searches, cart updates, or booking forms. A second critical pitfall is returning insufficient data from tools — responses like a bare success flag give agents nothing to act on, causing them to stall or produce inaccurate results. Developers are advised to treat every tool's return value as a formal API contract, always including structured, actionable data such as search results, updated totals, or confirmation details.

0 comments Read more at DEV Community
Developer accidentally discovers real CVE while testing AI bug-report verification tool · ShortSingh