Yes, obviously AI "works" in that if you throw massive compute at trivial automation tasks you get automation. AI "works" when you move the goalposts and include all machine learning and even conventional computing in your definition of AI. AI "works" for finding vulnerabilities in the sense that if you generate thousands of spurious reports with the right general form, some correspond to real issues by chance. AI "works" when there's a mechanical Turk providing the actual intelligence