All of these, presumably. The question is how many issue reports the maintainers of those two projects had to wade through to find those relevant twelve. And whether that took more work than they would have had to expend to find those bugs themselves or not.

Twelve of them.

As much as I advocate for human written code, we should also acknowledge that AI has gotten way more competent recently, esp. on the coding front. I think security and vulnerability scanning, (maybe together with code review?), should be the few valid uses of AI.

Also, remember that "AI" means scripts in this context. We've used scripts to scan for vulnerabilities for decades. That alone is neither new nor scary.

There are serions issues with AI, including how you define it, but scanning code for weak points itself, on its own, is not one. It's what you do with that data that matters.