Responsible disclosure is broken in 2026. All it takes is a vague implication that a vulnerability exists and there are enough people with enough AI tokens that it will be found quickly.