Why?

Google added that it doesn't believe its own Gemini models were used, but still has "high confidence" an AI model was part of discovering the vulnerability and weaponizing an exploit.

No, really, why? If Google itself or their models didn't discover the vulnerability, how would they know genAI was used on the discovery of the vulnerability and weaponization (interestingly, not "creation") of an exploit?