“OpenAI and these security companies sat on this for 2 months”

I don’t think this what happened at all, and even less so to specifically call out OpenAI.

The issue was discovered using their model, it was disclosed, and the PHP team took months to address it. Eventually it leaked.

This is a process / people failure that does not involve the people responsible for discovering it.