Crowdsourced bug bounties and pen-testing firms see AI agents stealing low-hanging vulns from their human counterparts, but oversight remains key.