It does happen in single cases: vendors sometimes sit on known bugs. But an AI model doesn't hold secrets about a company's code unless the code is in front of it, and unfiltered models don't change that. What AI changed is cost: reading huge codebases for a bug is now cheap, so old bugs that nobody had the time to look for turn up. Heartbleed sat in OpenSSL for two years for the same reason. A way to test a claim like yours: does the finding come with the exact code location and a reproducible exploit? If yes, it's a real bug whoever knew about it.