The AI cyber-disclosure gap