If that is so, why doesn't OAI have a swarm doing this around the clock?

Surely with all their security programs, they would run testing on the ChatGPT implementation.

I speculate that the AI didn't find this and that human effort and intuition for where to look were needed to find this vulnerability.

Who says they don't? And if they don't, maybe its because others are using their hard-earned money to buy tokens from them to do it, so they don't really have to.