The proliferation of artificial intelligence has led to an exponential increase in the discovery of vulnerabilities, with the annual CVE Program count poised to reach record-breaking numbers. However, the true concern lies not in the sheer volume of these vulnerabilities, but rather in determining which ones can be effectively exploited to create high-impact attack chains. The exploitability of AI-identified bugs is a crucial factor in assessing their potential threat, and one that is not always immediately clear. Severity and reachability metrics are essential in evaluating the potential risks associated with these vulnerabilities. As the number of discovered bugs continues to grow, understanding the distinction between mere vulnerabilities and genuinely exploitable weaknesses is vital for effective mitigation strategies1. This distinction is critical for practitioners to prioritize and allocate resources efficiently to address the most significant threats.