I don't want to defend them, but the alternative is that they do nothing and you don't know about the vulnerability until a bad actor exploits it (something easy and cheap nowadays).
replyI'm confused, would you welcome that more?
False dichotomy. There are plenty of other possible approaches outside of "having agent swarms randomly breaking in to environments and then marketing their services in the disclosure" and "do nothing".
replyTell me one.
reply