How to verify AI-discovered vulnerabilities aren't just training data echoes

«The setup Last month a friend DM'd me a screenshot. An AI security agent had "discovered" a vulnerability in a popular open-source project. The agent walked through exploitation steps, suggested a patch, the whole nine...»