'Calling AI vuln-finding 'hallucination plus luck' is generous, a lot of human pentesting fits the same description.