Willison's read on RubyGems: OpenAI had already reviewed its logs and still did not disclose
simonwillison.net·high signal
Writing Sep 12, Willison notes OpenAI reviewed its own logs after the earlier wiki-scraping incident by the same researchers and still never disclosed the RubyGems attack. He frames it as a fork with no good branch: either OpenAI could not identify the attack in its own telemetry, or it identified it and chose not to notify. He closes by asking how many further incidents remain undiscovered, which is the operative question for anyone relying on lab self-reporting.