Fair enough, and the timeline proved you right. JFrog published the advisory on July 27 with eight CVEs credited to OpenAI and a fixed build at Artifactory 7.161.15, and HF published the full technical writeup the same day, payloads included.
What I'd push back on now is the framing rather than the process. The bugs are ordinary: SSTI in a dataset loader, HDF5 external-reference file read, IMDS reachable from a pod, a shared connector credential bound to system:masters. The novelty is throughput, not insight, roughly 17,600 actions with most going nowhere. And the thing that should be getting the headline is that those eight Artifactory CVEs affect every self-hosted install below 7.161.15 regardless of whether you run any models at all. Patch first, debate the AI part later.
This is not the first time shallow AI news has taken the spotlight, hype marketing disguised as futuristic features or capabilities.