The CVE Program has opened a community discussion about what happens to the vulnerability-tracking ecosystem when AI starts finding bugs faster than humans can triage them. Its working groups have boiled the pressure down to five themes (scale, timing, abstraction, chainability and data quality), which a free virtual forum on July 30 is meant to hash out. That is the institutional version of the question the whole AI-and-CVE debate keeps circling: when anyone (or any model) can mint a CVE, what does the number still certify? A day later, the Program answered part of it: no bundling of several distinct vulnerabilities under one CVE ID, because a CVE ID names a vulnerability, not a patch, an advisory or a release. The models scale; the CVE-and-NVD metadata pipeline does not.
