> Do you think it took OpenAI a week to realize what happened ?

Apparently it did take them a while. This report here https://cloudsecurityalliance.org/artifacts/hugging-face-cis... includes extra details from a conversation Hugging Face:

> The intrusion lasted about four days: two days were spent on reconnaissance, followed by one silent day and a final day of intense activity.

That suggests OpenAI didn't spot what was happening for four days.