The headline is "AI uncovers...", implying that the standard static analyzers used by basically everybody didn't catch them.

isn't this just sort of turning chicken-or-egg?

if an AI uses static analyzers to do work ,is it the tool or the ai ?

if AI is using grep to do the work, is it the AI or grep?

I mean essentially all agent work boils down to "cat or grep?"