It would make sense, because I expect that they use Tor a great deal themselves. Perhaps they only anonymously report the bugs that they detect someone else po

It would make sense, because I expect that they use Tor a great deal themselves. Perhaps they only anonymously report the bugs that they detect someone else potentially exploiting? I'm sure they would try to maintain their ability to try and break the protocol, but perhaps if they think some other (non five-eyes intelligence) actor has discovered the vulnerability then they report it.