Unpopular opinion: If not you, then someone else will do it. If the team from @HacktronAI have not found it, someone might actually find the same and lead to a much more severe attack. (Just assume one can do everything with internal repos at OpenAI or access to employee accounts.) But instead of actually appreciating them, saying it is too far is also too far in my opinion. And sometimes to prove that you are worthy, it is also important to prove what kind of access you have. If they didn't create any PR, I'm dead sure they would have clearly said that 'Nah, you can't create such stuff, it isn't possible after patching everything'. I know these guys and have been following them for a long time. Glad, they put out their time and actually secured them.