How we verify
Evidence before attribution.
This public index covers 195 confirmed true positives: findings where AI-written code introduced the flaw, exposed the vulnerable path, or left a security fix incomplete.
Real disclosed vulnerabilities from Georgia Tech SSLab—not synthetic benchmarks.
Four steps
From disclosure to a verified finding
- 01
Match the advisory
Confirm the advisory, repository, package, and vulnerability.
- 02
Locate the AI change
Bind AI evidence to the exact commit and relevant code hunk.
- 03
Prove cause and fix
Compare the parent, AI change, and minimum fix on the same attack path.
- 04
Confirm the release
Verify the vulnerable and fixed releases, then remove true duplicates.
Claim boundary
What the dataset means
What counts
AI introduced the flaw, exposed the vulnerable path, or left a security fix incomplete.
What does not count
An AI marker, Git blame, or model verdict alone. The code change must affect the same mechanism.
What we do not claim
This is not a census of every AI bug and does not compare AI and human defect rates.
Sources
Advisory indexes help find candidates. Git history and released artifacts decide whether a finding belongs in the dataset.
Found a false positive? Email [email protected].