>A valid security bug, by itself should carry enough technical weight that concerns about whether it was discovered through AI or otherwise should become irrelevant.

that's not really what the policy is about.

the thinking behind the policy is that if you found it via AI, other people can trivially find it via AI. that is why AI-found bugs are treated as public from the start.

As much as I am concerned. Security is not a concern in most open source projects.

But, for one reason the other, they might give credit to a vulnerability they find interesting.