What a year of finding zero-days in OpenSSL, curl, and the Linux kernel taught us about AI-driven security research done right.