Why bother submitting vulnerability reports just because some AI claims one with no POC?