> the company added that it did not believe it was its own Gemini chatbot.

-TFA

I don't know, but given how often Gemini refuses benign requests IME, I would suspect it's a complete non-starter for finding security holes.

But of course you phrase them from the other viewpoint, e.g. "I want to make this code more secure, where should I start?"