A CVE triage pipeline that keeps asking, because day one tells you nothing

Sat, 31 Oct 2026 00:00:00 +0000

The pipeline is called Rappaport, after a scientist in Lem’s His Master’s Voice, a novel in which a team of researchers reads meaning into a signal from the stars and slowly learns that the meaning tells them more about themselves than about the signal. That is the failure I kept meeting in the field. A detection stack returns a confident verdict, and the confidence comes from how little it has seen. When partial signal can corrupt the verdict, priority cannot be read off whatever a record claims about its own severity. It has to be computed from signal that actually predicts exploitation, before anything a model could be talked into gets near it.

prompt-injection on HBCC

A CVE triage pipeline that keeps asking, because day one tells you nothing