Certainly both. About half of AI bug reports I get are invalid. Many others are questionable. It's a huge time sink figuring it out.

https://www.vulncheck.com/blog/anthropic-glasswing-receipts

That's kind of what I was afraid of. Both is really bad news. If you think of it in terms of average speed over ground, working on low quality reports is like spending a bunch of time at v=0.