# The AI Paradox in Vulnerability Ecosystem - Workshop At ENISA

**URL:** <https://discourse.ossbase.org/t/the-ai-paradox-in-vulnerability-ecosystem-workshop-at-enisa/1244>\
**Category:** GCVE\
**Created:** [November 13, 2026, 7:51pm UTC](https://discourse.ossbase.org/t/the-ai-paradox-in-vulnerability-ecosystem-workshop-at-enisa/1244 "2026-11-13T19:51:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![adulau](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/adulau/32/6_2.png) [@adulau](https://discourse.ossbase.org/u/adulau)\
**Post date:** [November 13, 2026, 7:51pm UTC](https://discourse.ossbase.org/t/the-ai-paradox-in-vulnerability-ecosystem-workshop-at-enisa/1244/1 "2026-11-13T19:51:09Z")

</div>

# The AI Paradox in Vulnerability Ecosystem

**CIRCL approaches**  
**Alexandre Dulaunoy** — [info@circl.lu](mailto:info@circl.lu)  
**ENISA Workshop 2026**  
**CIRCL** — [https://www.circl.lu](https://www.circl.lu)  
**Initiatives:** [https://gcve.eu/](https://gcve.eu/) · [https://vulnerability-lookup.org](https://vulnerability-lookup.org)

* * *

# The AI Paradox

## The paradox

> AI makes vulnerability discovery **faster and cheaper**.
> 
> Validation, coordination and publication **still require scarce human expertise**.

**Key message:** The bottleneck shifts from finding vulnerabilities to transforming findings into trustworthy vulnerability intelligence.

* * *

## Operational response: assist, trace, keep control

| Assist | Trace | Keep control |
| --- | --- | --- |
| Analyse patches | Evidence and sources | Local, open tooling |
| Suggest CVSS/CWE | Models and assumptions | Deterministic checks |
| Draft records | Human review state | Human publication |

> AI contributes annotations and drafts; the CNA, GNA or CSIRT remains accountable for disclosure.

* * *

# Provenance by Design

## GCVE BCP extensions: make assistance auditable

| Extension | Question it answers |
| --- | --- |
| **BCP-05-X-01** | Who used AI, for which fields, with what model and human review? |
| **BCP-05-X-02** | Which patch and assumptions produced the draft? What supports the CVSS/CWE/CAPEC conclusions? |
| **BCP-05-X-03** | Which known dates form the vulnerability timeline, including patch/commit evidence? |

> Machine-readable provenance helps analysts review AI output without treating the model as an authority.

**Reference:** [Index of /bcp/extension](https://gcve.eu/bcp/extension/)

* * *

# From Patches to Reviewed Records

## patch2vuln: from a fix to a structured draft

```mermaid
flowchart LR
    A["Patch evidence<br/>Git commits / URLs"] --> B["Deterministic checks<br/>Parse, validate, hash"]
    B --> C["Local Ollama<br/>AI-assisted analysis"]
    C --> D["Structured draft<br/>CVE / GCVE + more"]
    D -.-> E["Evidence travels with the draft<br/>Patch hashes, model details, assumptions,<br/>suggested classifications, review state"]

    classDef source fill:#edf4fc,stroke:#2668a0,color:#23445c,stroke-width:1px;
    classDef compute fill:#eaf8f6,stroke:#168c91,color:#23445c,stroke-width:1px;
    classDef output fill:#eef0f3,stroke:#23445c,color:#23445c,stroke-width:1px;
    classDef evidence fill:#f5f8fc,stroke:#98aeca,color:#23445c,stroke-dasharray:4 3;
    class A source;
    class B,C compute;
    class D output;
    class E evidence;

```

- Proposes affected products, descriptions, CWE/CAPEC, CVSS v4, SSVC and remediation.
- Calculates CVSS scores deterministically from vectors; keeps proposals reviewable.

**Repository:** [GitHub - gcve-eu/gcve-lab-patch2vuln: patch2vuln is a command-line tool that turns a git-format patch into a structured draft vulnerability advisory using a locally hosted Ollama model. · GitHub](https://github.com/gcve-eu/gcve-lab-patch2vuln)

* * *

## Recent patch2vuln improvements

- **Better evidence:** Multiple related commits, release-tag checks for fixed versions and CPE 2.3 suggestions reviewed against `cpe.gcve.eu`.
- **Better analysis:** Multi-model comparison, disagreement flags, CVSS v4 and SSVC v2.1 Supplier decisions.
- **Better provenance:** AI annotation, patch-to-vulnerability evidence and a patch-based timeline (BCP-05-X-01/02/03).
- **Better access:** Web interface, REST/OpenAPI and asynchronous analysis jobs (v1.3.0).

> A reproducible, inspectable starting point for analysts—not an automatically approved advisory.

* * *

## patch2vuln v1.3: queued analysis service

```mermaid
flowchart LR
    A["Web UI / REST clients"] --> B["Flask API<br/>Submit / poll"]
    B --> C[("SQLite queue<br/>Persist jobs")]
    C --> D["Worker<br/>Embedded or standalone"]
    D --> E["Local Ollama<br/>Run analysis"]
    E --> F["Job status + JSON<br/>Downloadable results"]
    F -- "Poll / retrieve" --> A

    classDef source fill:#edf4fc,stroke:#2668a0,color:#23445c,stroke-width:1px;
    classDef compute fill:#eaf8f6,stroke:#168c91,color:#23445c,stroke-width:1px;
    classDef output fill:#eef0f3,stroke:#23445c,color:#23445c,stroke-width:1px;
    class A,C source;
    class B,D,E compute;
    class F output;

```

- Resumable asynchronous analysis, with an embedded or separate worker.
- Bulk patch inputs, previews, JSON inspection, downloads and OpenAPI documentation.

**Documentation:** [https://github.com/gcve-eu/gcve-lab-patch2vuln/blob/main/docs/web-service.md](https://github.com/gcve-eu/gcve-lab-patch2vuln/blob/main/docs/web-service.md)

* * *

## Vulniverse integrated into patch2vuln

```mermaid
flowchart LR
    subgraph auto["Automated preparation"]
      direction LR
      A["Patch<br/>Commit / diff"] --> B["CVE 5.2 draft<br/>Generated fields"]
    end
    subgraph analyst["Analyst control"]
      direction LR
      C["Vulniverse<br/>Edit + validate"] --> D["Export JSON<br/>Reviewed draft"]
    end
    B --> C
    D -.-> E["Embedded in the patch2vuln web interface<br/>Schema checks support review;<br/>export does not publish the advisory"]

    classDef source fill:#edf4fc,stroke:#2668a0,color:#23445c,stroke-width:1px;
    classDef compute fill:#eaf8f6,stroke:#168c91,color:#23445c,stroke-width:1px;
    classDef review fill:#fff6e5,stroke:#b77c22,color:#23445c,stroke-width:1px;
    classDef output fill:#eef0f3,stroke:#23445c,color:#23445c,stroke-width:1px;
    classDef evidence fill:#f5f8fc,stroke:#98aeca,color:#23445c,stroke-dasharray:4 3;
    class A source;
    class B compute;
    class C review;
    class D output;
    class E evidence;

```

- Inspect the AI output, correct individual fields and validate the CVE schema.
- Other generated advisory formats remain available for download.

**Repository:** [GitHub - vulnerability-lookup/vulniverse: Vulniverse is a web-based editor for authoring, reviewing, validating, and storing vulnerability records. It is intended as a modern replacement for Vulnogram, with integration as a first-class goal: use the complete standalone application, embed the editor in Vulnerability-Lookup, or connect it to any software that works with the CVE Record Format · GitHub](https://github.com/vulnerability-lookup/vulniverse)

* * *

## Vulnerability-Lookup: an integrated analyst workflow

```mermaid
flowchart TB
    subgraph VL["Vulnerability-Lookup + embedded Vulniverse"]
      direction LR
      A["Select patch<br/>Analyst request"]
      B["Review proposed fields<br/>Edit + quality checks"] --> C["Save draft<br/>CNA / GNA path"]
    end

    subgraph P2V["patch2vuln service — local inference"]
      direction LR
      D["API proxy<br/>Submit job"] --> E["Job queue + worker<br/>Local Ollama"]
      E --> F["Draft + provenance<br/>Suggested fields"]
    end

    A --> D
    F -- "Result to review" --> B

    classDef source fill:#edf4fc,stroke:#2668a0,color:#23445c,stroke-width:1px;
    classDef compute fill:#eaf8f6,stroke:#168c91,color:#23445c,stroke-width:1px;
    classDef review fill:#fff6e5,stroke:#b77c22,color:#23445c,stroke-width:1px;
    classDef output fill:#eef0f3,stroke:#23445c,color:#23445c,stroke-width:1px;
    class A source;
    class D,E,F compute;
    class B review;
    class C output;

```

> The analyst chooses which suggestions enter the record; publication remains a separate, authorised CVD step.

**Documentation:** [AI-Assisted Vulnerability Records — Vulnerability-Lookup](https://www.vulnerability-lookup.org/documentation/ai-assisted-records.html)

* * *

## The human review is an explicit boundary

| Automate | Validate before publication |
| --- | --- |
| Patch parsing and summarisation | Vulnerability and exploitability |
| Draft classifications and metrics | Affected versions / products |
| Format conversion and provenance | CVSS, CWE, CAPEC, SSVC |
| Queueing and repeatable checks | Credits, coordination, disclosure |

> **Review boundary:** Model output is a draft; security judgement, publication authority and accountability stay with the analyst and disclosure coordinator.

* * *

## Interoperability: one analysis, several formats

```mermaid
flowchart TB
    A["Patch evidence + AI analysis<br/>One reviewable source"]
    A --> B["Shared provenance<br/>Evidence, model, assumptions, human review"]
    B --> C["CVE 5.2<br/>Draft"]
    B --> D["GCVE BCP-05<br/>Draft"]
    B --> E["CSAF 2.1<br/>Draft"]
    B --> F["OSV<br/>Draft"]

    classDef compute fill:#eaf8f6,stroke:#168c91,color:#23445c,stroke-width:1px;
    classDef evidence fill:#f5f8fc,stroke:#98aeca,color:#23445c,stroke-dasharray:4 3;
    classDef output fill:#eef0f3,stroke:#23445c,color:#23445c,stroke-width:1px;
    class A compute;
    class B evidence;
    class C,D,E,F output;

```

- Different publication formats should not lose the supporting evidence and rationale.
- Vulnerability-Lookup connects editorial work to CNA/GNA publication services.

> Interoperability is more than JSON conversion: review and provenance must survive.

* * *

## The CLI is still useful

```bash
python3 patch2vuln.py \
  --gcve-id GCVE-1-2026-20206 \
  --vendor misp --product misp \
  --all-formats-output advisories \
  https://github.com/MISP/misp/commit/382188d2f.patch

```

- Produces CVE, GCVE, CSAF and OSV drafts for analyst review before publication.
- CLI, web interface and API share the same analysis engine.
- Analyst-supplied facts take priority over model inference.

* * *

# Scalable Analysis and CVD

## Complementary enrichment: VLAI and AI annotations

```mermaid
flowchart TB
    subgraph training["Model development"]
      direction LR
      A["Historical data<br/>Vulnerability-Lookup"] --> B["Fine-tune<br/>RoBERTa"]
      B --> C["VLAI model<br/>Local weights"]
    end
    subgraph inference["Local inference / enrichment"]
      direction LR
      D["New description<br/>Incoming record"] --> E["VLAI inference<br/>Severity class"]
      E --> F["Annotation<br/>Vulnerability-Lookup"]
    end
    C -- "Model weights" --> E

    classDef source fill:#edf4fc,stroke:#2668a0,color:#23445c,stroke-width:1px;
    classDef compute fill:#eaf8f6,stroke:#168c91,color:#23445c,stroke-width:1px;
    classDef output fill:#eef0f3,stroke:#23445c,color:#23445c,stroke-width:1px;
    class A,D source;
    class B,C,E compute;
    class F output;

```

- Early severity suggestion when authoritative scores are not yet available.
- `gcve-eu-ai-extension` can add BCP-05-X-01 provenance to AI annotations.

**Documentation:** [AI datasets and VLAI models – Vulnerability-Lookup](https://www.vulnerability-lookup.org/user-manual/ai/)

* * *

## From increased discovery to scalable disclosure

```mermaid
flowchart LR
    A["DISCOVER<br/>Patches / reports<br/>Vulnerability evidence"] --> B["ASSIST<br/>patch2vuln<br/>Draft + provenance"]
    B --> C["VALIDATE<br/>Human review<br/>Vulniverse + VL"]
    C --> D["PUBLISH<br/>CNA / GNA<br/>Publication"]
    D --> E["After publication<br/>Sightings, enrichment,<br/>correlation, record updates"]
    E -- "Review updates" --> C

    classDef source fill:#edf4fc,stroke:#2668a0,color:#23445c,stroke-width:1px;
    classDef compute fill:#eaf8f6,stroke:#168c91,color:#23445c,stroke-width:1px;
    classDef review fill:#fff6e5,stroke:#b77c22,color:#23445c,stroke-width:1px;
    classDef output fill:#eef0f3,stroke:#23445c,color:#23445c,stroke-width:1px;
    classDef evidence fill:#f5f8fc,stroke:#98aeca,color:#23445c,stroke-dasharray:4 3;
    class A source;
    class B compute;
    class C review;
    class D output;
    class E evidence;

```

> Local AI increases analyst capacity; controlled disclosure and open standards preserve trust.

* * *

## Takeaways

1. **The bottleneck has moved:** More discoveries mean more validation and CVD work.
2. **Provenance matters:** GCVE BCP-05-X-01/02/03 expose assistance, evidence and timelines.
3. **patch2vuln now scales:** Queued web/API jobs, bulk drafts, richer classifications and multiple output formats.
4. **The integrations close the loop:** Vulniverse for review; Vulnerability-Lookup for coordinated recording and publication.
5. **Humans decide:** Automation drafts and enriches, analysts verify and publish.

* * *

## Thank you for your attention

- **GCVE BCPs:** [GCVE.eu - Best Current Practice (BCP) – GCVE initiative - Global CVE Allocation System](https://gcve.eu/bcp/)
- **patch2vuln:** [GitHub - gcve-eu/gcve-lab-patch2vuln: patch2vuln is a command-line tool that turns a git-format patch into a structured draft vulnerability advisory using a locally hosted Ollama model. · GitHub](https://github.com/gcve-eu/gcve-lab-patch2vuln)
- **Vulniverse:** [GitHub - vulnerability-lookup/vulniverse: Vulniverse is a web-based editor for authoring, reviewing, validating, and storing vulnerability records. It is intended as a modern replacement for Vulnogram, with integration as a first-class goal: use the complete standalone application, embed the editor in Vulnerability-Lookup, or connect it to any software that works with the CVE Record Format · GitHub](https://github.com/vulnerability-lookup/vulniverse)
- **Vulnerability-Lookup:** [https://www.vulnerability-lookup.org/](https://www.vulnerability-lookup.org/)
- **VLAI:** [AI datasets and VLAI models – Vulnerability-Lookup](https://www.vulnerability-lookup.org/user-manual/ai/)
- **Questions:** [info@gcve.eu](mailto:info@gcve.eu)

🔗 [PDF Presentation](https://discourse.ossbase.org/uploads/short-url/k2fatZgeAWvKDsgZQIHEn7Blrah.pdf) (203.9 KB)