The information they feed from is simple, clear, and static. And yet the both of them are hallucinating mitigations, compromise indicators, and other details of the vector that flatly don't exist.
The question GP posed wasn't bait. It's still a blatant problem in 2026. It's not just shitty cheap models, either. Just this morning I caught 6.1 Sol (via Codex) incorrectly answering a question about the codebase it was actively working in.
Two very modern counterexamples:
https://app.opencve.io/cve/CVE-2026-83844
https://www.sentinelone.com/vulnerability-database/cve-2026-...
The information they feed from is simple, clear, and static. And yet the both of them are hallucinating mitigations, compromise indicators, and other details of the vector that flatly don't exist.
The question GP posed wasn't bait. It's still a blatant problem in 2026. It's not just shitty cheap models, either. Just this morning I caught 6.1 Sol (via Codex) incorrectly answering a question about the codebase it was actively working in.