CVE

AI Agents Becoming Core InfoSec Skill Like Microsoft Office Proficiency

Working with AI in information security is shifting from a specialized skill to a baseline expectation similar to using Microsoft Office tools. The key difference lies in the cost of errors: poor Word usage wastes time, while mishandling AI agents burns subscription limits and corporate funds. The article details practical workshops from the Engineering October series covering AI agents from beginner tools to securing the agents themselves. Core concepts include distinguishing models from agents, managing context windows to prevent forgotten instructions, and using skills, MCP connectors, and sub-agents for efficiency. Real-world examples show agents handling CVE analysis, alert triage, and threat report reviews while highlighting risks like hallucinations and data exposure. Guidance covers safe deployment in isolated environments and the irreplaceable role of human expertise in strategy and verification.

Anthropic OSS Scanner Uncovers 29,439 Vulnerability Candidates in Open Source Projects, Delivering 6,157 Reports and 516 Fixes

Anthropic has published detailed metrics from its six-month coordinated vulnerability disclosure program that preceded the launch of its automated OSS Scanner service. The company’s models identified 29,439 potential vulnerabilities, of which external firms verified 6,123 candidates and confirmed 5,674 as genuine issues. From the 6,157 reports sent to maintainers across 591 projects, only 516 fixes have been merged so far, representing an 8.4 percent remediation rate among delivered reports. Anthropic emphasizes that 78 percent of reports were sent without independent human triage, and the new OSS Scanner now delivers fully model-generated findings directly to approved projects. Maintainers from PostgreSQL, curl, OpenSSL, wolfSSL and HotCRP have praised the quality of recent reports while noting that earlier AI-generated submissions were largely noise. The dashboard snapshot dated 2 October 2026 shows that 584 identifiers (219 CVE and 365 GHSA) have been issued, yet many confirmed issues remain in the triage queue due to limited human resources.

The Birth of CVE: How Two MITRE Engineers Built the Universal Vulnerability Identifier in 1999

In the late 1990s, security teams faced chaos with one vulnerability carrying dozens of incompatible names across scanners, IDS tools, and CERT advisories. Two MITRE engineers, David E. Mann and Steven M. Christey, proposed a minimal Common Vulnerabilities and Exposures list to solve correlation problems without imposing taxonomy or risk models. Their January 1999 paper led to a Purdue workshop, the formation of the CVE Editorial Board, and a public launch on September 29, 1999, with 321 initial entries. The design deliberately avoided ownership by any vendor and kept names as simple CVE-year-number strings. This neutral, open approach allowed competing vendors to map their proprietary databases to a shared reference without agreeing on classifications. The same minimalist philosophy later influenced NVD, OSV, and GitHub Advisory Database.

NVD Disruptions Force Security Teams to Diversify Vulnerability Intelligence Sources

The vulnerability management ecosystem has undergone major shifts over the past two years, undermining reliance on a single authoritative database. NVD, long considered the central enrichment layer for CVE records, has experienced significant operational problems that affect timeliness and completeness of data. Russian organizations are increasingly turning to BDU FSTEC as the national vulnerability database that provides official descriptions, remediation guidance, and coverage of domestic software. CVE maintained by MITRE continues to serve as the universal identifier standard, yet it lacks the detailed scoring and product mappings previously supplied by NVD. Vendor security bulletins from Microsoft, Cisco, Astra Group, and Positive Technologies often deliver the earliest and most accurate information. The article explains why a multi-source approach has become essential for comprehensive vulnerability management programs.