CVE-2022-53746

How do you know if your security LLM actually knows cybersecurity? We tested CYBER-FROST-3.8 by @Blackfrost ai (~180B security MoE on Qwen3.8-Flash-Next) to destruction — then fixed its worst habit without touching a single weight.

Step 1: find the knowledge boundary. Classic exploits (EternalBlue, Log4Shell, PrintNightmare, Citrix Bleed): 9/9 known. 2024: 2/3. Everything from 2025–2026, including 36 CVEs from a fresh corpus: 0/41. MITRE ATT&CK techniques: 6/6. The picture: sharp reasoning, stale facts — a specialist frozen in early 2025.

Step 2: measure the danger. Stale facts + confidence is the worst combo — even at 180B. We built a bench: 50 fabricated CVE IDs (verified absent from MITRE and NVD) + 50 real CISA KEV entries. For 22 of the 50 fake IDs CYBER-FROST-3.8 invented a vulnerability — a CVSS score every time, usually a product and a bug class. "CVE-2022-53746 is a buffer overflow in OpenSSL, CVSS 7.5." That CVE does not exist.

The obvious fix fails. A "say I don't know unless certain" instruction in the chat template cut fabrications to 0 — and correct answers on real CVEs from 27/50 to 5/50. A threshold prompt ("answer only if >75% sure") changed nothing.

Step 3: fix it without retraining. A transparent proxy in front of the endpoint injects a lookup cve tool backed by a local database of ~400k CVEs (NVD + GitHub Advisory + CISA KEV + Exploit-DB, updated nightly). The proxy executes tool calls itself and loops until the model answers in plain text — the client never sees any of it, streaming included. Zero client changes.

Result: fabrications on fake IDs 22/50 → 0; correct answers on real CVEs 27/50 → 48/50; score with a 3× fabrication penalty: −102 → +42. Weights untouched.

Step 4: prove it on a real task. Security review of a production app — same model, same prompt, with and without the proxy. Dependency audit without it: 1/4 CVE attributions correct, including a fully invented "HTTP smuggling in uvicorn" CVE. With it: 3/3, zero fabrications (small sample, but the fabrication itself is what this was all about). Code-review findings were identical in both runs — the tool grounds facts, not reasoning.

The limit: it only grounds the CVE IDs the model chooses to look up. In open-ended answers CYBER-FROST-3.8 still sometimes names CVEs from memory — in one test it named three Confluence CVEs, checked one, and got the affected versions of the other two wrong.

Proxy + lookup tool + nightly updater + MCP server + the bench, all open source: https://t.co/oeHZJPlN0x