Two frontier labs independently landing on the same critical flaw is the strongest signal yet that AI has become a real instrument of vulnerability research, not a demo reel. The convergence is what matters here: when GPT-5.6 Sol and Gemini 4 Argon reach the same result without coordination, such findings stop being lucky breaks and become reproducible at scale. The dual-use caveat from OpenAI is arguably the real headline — the same scanning capability is trivially available to attackers, and disclosure pipelines were designed for human-speed research. You can expect bug bounty programs and CISO budgets to adapt faster than disclosure norms will. On our view, the defensive lead is real but temporary; the interesting race is who industrializes autonomous exploitation first.