- What subsystems are affected?
- What's the median age of the vulnerable code? Is more recent code stronger than old ones?
- What is the type of vulnerabilities found? Memory corruptions, logic bugs, race conditions, ...
This is an impressive result, but we need more info to understand how well this would translate to another codebase, and what lessons can be drawn from this experiment. Not every company has ~million dollards in tokens to spend.
Also, let's maybe not call the result impressive until we see what's under the hood.
These are relatively simple statistics. Some are even trivial. I don't see why it requires any people at all.
It wouldn't even have to be done by OpenAI. Given a list of vulnerabilities, it wouldn't be too hard for third parties to collect these statistics.