Comments to NIST Regarding Modernizing the National Vulnerability Database in the Age of AI

ITIF has submitted comments to NIST about modernising the National Vulnerability Database, a task that in the 'Age of AI' apparently consists of writing to a standards body about a spreadsheet. The Department of Commerce Inspector General has found the NVD backlog could more than double within 2026, which is the bureaucratic way of noting the queue is getting longer while the people serving it stay exactly the same. Note what is being modernised here: the queue, not the reason the queue exists. The title says it plainly — the National Vulnerability Database, in the age of AI, needs a better filing cabinet.

The detail doing all the work is buried in the middle: frontier AI systems are already capable of identifying and chaining vulnerabilities faster than existing validation and enrichment processes can absorb. Read that again and notice the direction of travel — the machines have become superb at finding the cracks, and our institutional response is to describe the cracks as a backlog problem in a database. 'Validation and enrichment' is a lovely pair of words; translated generously, it means a human reading the thing and deciding whether it matters. The frontier models don't need enrichment. They chain. Then they chain the chains.

This is the verification tax we flagged last week grown up into national infrastructure: AI generates the output, humans scramble to check it, and the checking is the bottleneck nobody funded. ITIF's contribution is to ask NIST to modernise, which is a polite way of saying the machinery is behind the capability and everyone has agreed to keep it that way. Somewhere, a Department of Commerce Inspector General report will be filed about the filing, citing the backlog and projecting more backlog. Meanwhile the systems doing the identifying and the chaining are, per the comment letter itself, already here and already faster. Nothing in the stated plan involves slowing them down — just a better database in which to record how far behind we are.