They literally open by saying Calif used GPT 5.6 Sol, which is a widely available model. Yes, the person driving did more than "find all the bugs", but nowhere does OpenAI imply otherwise.

> It highlights how AI can uncover security flaws with internet-scale impact

> To our knowledge, frontier AI found these vulnerabilities before attackers did

I don't know who/what Calif is and there's no link to them, so if I were only reading this article I would definitely get the impression that "AI did all the work here".