If OpenAI cared about open source or security, they'd give access to open source projects directly. But they don't:

https://openai.com/form/enterprise-trusted-access-for-cyber/

"Daybreak enables vetted enterprise customers and cybersecurity practitioners to use our most capable models for dual-use cybersecurity work."

They explicitly give out access to those who will make a big announcement of bugs found. OpenAI does not want projects to fix bugs themselves so it can have more bugs and better marketing.

That's the wrong program for open source.

https://openai.com/form/codex-for-oss/ is their program for giving access directly to open source maintainers directly so they can fix bugs.