What is Hallucinated vulnerabilities? Definition and why it matters
===================================================================

Confident, plausible findings that do not reproduce. The curl project ended its bug bounty on 31 January 2026 after confirmed-report rates fell below five percent.

Detail: Hallucinated findings are the cost side of AI auditing. The mitigations that work are execution-based validation (sandboxed exploits, fuzzing oracles), a second validating agent, and a human who reproduces before reporting.

Source page: https://agentsast.com/glossary/hallucinated-vulnerabilities/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13