yeah assuming no funny games the threat is real and the primary thing this CTF did while it was misconfigured and on the front page was convince people that the threat was not real. that is probably not an ideal outcome.

similarly to the guy from Trail of Bits talking about how it looked like a trap - apparently this PoC was not impossible for someone else to figure out, the window was not as long as you'd hope (again assuming no funny business), and the "trust me bro this exploit is real" messaging just kind of kills overall credibility and does more harm than good. As does a misconfigured CTF, potentially. People do not have a positive view of tech and especially AI right now and if there's a real threat then fueling the "it's just hype to boost stock price for IPO" narrative is maybe a bigger issue than the vulnerability itself no? Because you also tank your ability to get people to take any future vuln seriously.

Plus a broken CTF is apparently a good way to get people to not take a current vuln seriously while also working as a honeypot to get PoCs. Probably everyone involved with good intentions should make sure they're really thinking through all the implications (preferably ahead of time so there's a playbook). Meaning societal/psychological/narrative implications too and not just technical. Security of all fields should be deeply familiar with how human behavior is kind of critical, no? How many people reuse passwords? The AI industry is uniquely incompetent at this aspect. Like all the datacenter stuff where they make secret deals for tax breaks and cheap land with city councils under NDA and then are suprised that constituents react badly to being taken for a ride by an industry and elected officials they already don't trust. Like just from an optics perspective, charging for daybreak or similar frontier cyber-capable AI to defend from AI discovered/led vulnerabilities and attacks - y'all get how this looks like a protection racket right?

The worst outcome here is AI cyberwar/CVE-apocalypse hitting while the industry is treated as the boy who cried wolf even when there actually were previously wolves because everyone involved just sucks at comms and doesn't think things through and now has no credibility to organize a response.