One of the premises of the CRA is the fact that you can share info on the existence of a vulnerability + mitigation measures without helping a potential attacker. In the age of AI, that might not be true any more if https://anil.recoil.org/notes/rumour-is-the-exploit is to be believed.