{
  "slug": "hallucinated-vulnerabilities",
  "term": "Hallucinated vulnerabilities",
  "definition": "Confident, plausible findings that do not reproduce. The curl project ended its bug bounty on 31 January 2026 after confirmed-report rates fell below five percent.",
  "detail": [
    "Hallucinated findings are the cost side of AI auditing. The mitigations that work are execution-based validation (sandboxed exploits, fuzzing oracles), a second validating agent, and a human who reproduces before reporting."
  ],
  "page": "https://agentsast.com/glossary/hallucinated-vulnerabilities/",
  "updated": "2026-09-13"
}