"President Obama has decided that when the National Security Agency discovers major flaws in Internet security it should – in most circumstances — reveal them to assure they get fixed, rather than stockpile them for use in espionage or cyberattacks, senior administration officials said Saturday."

Emphasis added is mine.

The "in most circumstances" means they can pretty much do whatever the hell they want.