I got some "security fixes" from AI companies on one of my projects too. Turned out to be an issue my own AI code reviews had already caught and which was already being tracked in my TODO list.

The fix itself looked good enough but I didn't merge it because the commit message was essentially an advertisement for the company that sent the fix.