> I have a sneaking suspicion that people are having some agent check out 500 repos and just prompting with “find a bug in this repo and fix it” and submitting the results blindly.

From the reports coming from a number of places, I'm absolutely sure this is what is happening. People want the glory of finding a named bug, perhaps they believe some more widely useful reputation gain is heading their way if something that their bot finds is actually massively significant. Though it isn't limited to 500 repos, they tell it to just keep going after every one it scans.