Hugging Face disclosed the attack. OpenAI owned up to it a week later. It's unclear when and if OpenAI would have disclosed it if HF hadn't already done so.

For a more recent example, OpenAI was chastised by Australia recently for notifying them three months after their agents attacked AUS government websites.

[0] https://news.ycombinator.com/item?id=49825580