I think it's a reasonable ask to know: * What is the vulnerability? * Am I affected?

It's very difficult to answer those two questions, through all the marketing and fluff text.

If you read the calif report

> No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts.

They used a public model as a research assistant and a code assistant. They guided it with expert deep knowledge of the project. OpenAI did not lead this, ChatGPT was not instrumental in this.

It is perhaps at best to say OpenAI made it possible to find the bug more quickly. And on the double edged sword, also made it easier for it to be exploited days ahead of release. So I agree with the original commentator, did they on the balance actually do anything good here?

Is this about my comment about Calif being the ones who found the vulnerability and not OpenAI? Am I wrong?