AI is widening the gap between the CVEs teams find and the ones they can fix. Closing it means asking which flaws attackers can actually reach.