Proof-of-Concept Debt: Measuring the Timeliness and Noise of Public Exploit Disclosure as Exploitation Intelligence

Abstract

Background: Public proof-of-concept (PoC) exploits — on GitHub, in Exploit-DB, in security blogs — are consumed as exploitation intelligence: a working PoC is treated as evidence that a vulnerability is exploitable now . The published record supports the timeliness claim: CMU SEI's measurement of 75,807 CVEs found that, given a public exploit eventually appears, its median time-to-publication is just 2 days after patch release (mean 91 days) — and modern reporting (e.g., LLM-CVX, 2025) reaffirms the 2-day median against patched vulnerabilities. Objective: We analyze the PoC corpus as an intelligence source and expose its structural weakness: the corpus is not a signal but a debt — an accumulating body of artifacts whose quality, attribution accuracy, and safety properties vary without any verification standard. Methods: Synthesis of the published exploitation-timing measurements; construction of a PoC-corpus noise taxonomy; and a six-risk-versus-six-verification-mechanism assessment. Results: The corpus's value is real (2-day median timeliness for the exploited minority) but its consumption failure modes are severe and unmeasured: stale PoCs that no longer reproduce inflate "exploit exists" counts; malicious PoCs weaponize the verification step itself; PoC-CVE mislabeling corrupts attribution; and per-PoC verification cost is the reason none of this is routinely checked. We specify the verification harness — sandboxed reproduction with attestation, provenance scoring, and CVE/product binding validation — whose absence defines the debt. Conclusions: "Public exploit exists" should be treated as an unverified hypothesis, not a signal. The intelligence layer needs PoC verification as an infrastructure service, with attested reproduction results — and consumers should budget verification cost explicitly rather than treating corpus membership as evidence.