This is really a corporate problem of their own making and their responsibility to fix. They have lied so much, I do not owe then a single iota of trust.
The statements can stand for themselves, evaluated on the merits of the claims, regardless of authorship. That's how these things should work. Someone who has a great history of finding vulnerabilities still has to stand by each exploit/proof of concept they write, on its own merits. On the flip side, the corollary to the adage that a broken clock is still right twice a day is that you can't just say "oh the broken clock said this so I can ignore it."
Do you really think any of them would post something like "yeah, we found a vulnerability but it's basically a typo that could not be seriously exploited"?
The blog post literally describes exactly that, for ffmpeg. And several of the other described vulnerabilities sound like they're in that category of "here's a bug but we didn't find an exploit."
Simply refusing to engage with these big claims just because of the source is an irresponsible way to approach cybersecurity.
even if the whole scenario is real, it may not have the intervention of Ai they are claiming
...who cares? If it's a real bug and a real PR addressing the bug, why does authorship or methodology matter?
It's just the ad hominem fallacy (or the close relative, appeal to authority). Let the actual substance stand and fall on its merits. Read the described vulnerabilities and exploits and decide whether you think those need to be patched and how critical/severe the bugs/vulnerabilities are.
And maybe your priorities are different from mine, but the core of the claim (we found some vulnerabilities) trigger a responsibility to address them (confirm and patch). I don't care about marketing or corporate interests or whatever in those circumstances, I'm just focused on fixing problems that have been found.