Comment by BlueTemplar

Because in other circumstances, a hacker might have decided to stop there, and not only not publish, but instead warn the website about their security flaw.

Especially after Bluetouff was found guilty.

In fact, I expect this to have happened many times, but "hacker did the right thing" is much less likely to make headlines.

Meanwhile, agent swarms seem to be (mostly ?) incapable of having this kind of moral compass, at least for now. (And OpenAI isn't doing much better, cough.)