Such a misleading title. Change it to "qualified security researchers found a vulnerability in OpenAI via an official bug bounty process" and all of a sudden it is completely uninteresting. "System used as designed."