Certainly both. About half of AI bug reports I get are invalid. Many others are questionable. It's a huge time sink figuring it out.

https://www.vulncheck.com/blog/anthropic-glasswing-receipts