PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Why LLMs Hallucinate Vulnerabilities

xbow.com | research | #ai-security | #appsec | #llm | #false-positives | #validation | #hallucination
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Explains why LLMs produce confident but false vulnerability findings (plausibility is not proof) and why results must be validated against real system behavior.
Published
Collected

Related coverage

research · xbow.com
Machine Learning for Vulnerability Discovery
Machine learning accelerates vulnerability discovery but over-reports false positives without runtime context; the article argues for pairing ML detection with AI-driven exploitability validation.
blog · borghq.io
Security Review for AI-Generated Code: What Changes Before Merge
More of every pull request is machine-drafted and the bug classes have not changed. What security review must catch in the diff before merge, and what it cannot.
blog · projectdiscovery.io
Continuous PR Security Review
Post-mortem vulnerabilities often look harmless in the diff—they only surface at runtime. ProjectDiscovery says LLM code review hits just 63% precision, so PRs need validation on a running app.
research · portswigger.net
Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
Kettle explains how to distinguish HTTP pipelining false positives from real request smuggling, covering connection-locked smuggling, connection state attacks and client-side desync.
research · hackerone.com
We Benchmarked Opus 4.7 on Vulnerability Validation. Here's What We Found.
HackerOne ran Claude Opus 4.7 through two vulnerability validation benchmarks, finding its biggest gains in filtering invalid findings and producing more accurate, evidence-backed verdicts for triage teams.
research · bugcrowd.com
Reducing Noise in Crowdsourced Security
Bugcrowd explains signal-to-noise in crowdsourced security: how triage teams weed out false positives, how the ratio is calculated, and what makes valid findings flow to customers.
Back