AI slop CVEs can trigger harmful patches. Require provenance, source, reachability, reproduction, and fix evidence before auto-remediation.