LATIDIA · Ciberseguridad

Narrativas engañosas: un estudio empírico de cómo los LLM juzgan erróneamente la gravedad de CVSS en los informes de recompensas por errores

arXiv: 2610.24623v1Tipo de Anuncio: nuevo Resumen: Las plataformas de recompensas por errores reciben informes de vulnerabilidad más rápido de lo que los proveedores pueden clasificarlos, y los Modelos de Lenguaje Grande (LLM) se consideran cada vez más para asignar el Commo

La noticia

arXiv:2610.24623v1 Announce Type: new Abstract: Bug bounty platforms receive vulnerability reports faster than vendors can triage them, and Large Language Models (LLMs) are increasingly considered for assigning the Common Vulnerability Scoring System (CVSS) severity that drives prioritization. Prior evaluations score short CVE descriptions and report accuracy, but deployment depends on how models err, not only how often. CVSS gives each metric a formal meaning that departs from how researchers describe impact in narrative reports, and model rationales suggest that errors concentrate where the two diverge; we ask whether this pattern is systematic. From 4,281 publicly disclosed reports mined from Huntr and HackerOne, we build a benchmark of 240 Huntr reports