It does show that it can be a useful tool, though.

Here, the security researcher was evaluating it and stumbled upon a previously undiscovered security bug. Obviously, they didn’t let the AI create the bug report without understanding it. They verified the answer and took action themselves, presumably analyzing, verifying, and reporting in a professional and respectful way.

The cURL AI spam is an issue at the opposite side of that. But doesn’t really tell us anything about capabilities. It tells us more about people. In my eyes, at least.