The NSA reports most of the bugs it finds in operating systems, but only after a delay while it uses them to attack computers.