On Fridsay, vague rumblings of tailscale SSH security problems. I joked that someone else should point an agent at the vague area.
On Saturday morning, I set GLM-5.3 running, looking for the problem. I told it I ran tailscale at home and wanted to know what the problem was. It did not take long, nor much money (<10 USD) to find some issues.
On Saturday evening, Tailworm came out with very similar issues. On Sunday, tailscale commented.
I don’t think vague disclosure is a good idea. It gives the attacker (or their agent) a much reduced search space. It spreads FUD (and on a Friday no less). Either keep quiet or go full disclosure. I was amazed at how easy it is to find an issue with a agent.