I'm not sure why you are getting down voted so much instead of actually engaging with your post. I think you are right about that the disclosing is the right thing to do, but i believe that the problem people have with this whole AI hacking and disclosing is the intent behind the hacking. A white hat hacker has a clear intend to help discover and responsibly disclose the issue, maybe even for a bounty, giving an indirect permission to white hat hacking. On the other hand, AI does not have a clear intend behind the hacking. Very often it's accidental and done irresponsibly like a "woopsie doozy, sorry we just broke in, we didn't mean to, and we are not really sure what files were accessed but pinky swear we think we did no harm 🫣🤗" that is at least my take on this and why I think is very problematic. AI can still be used responsibly as a tool by a white hat hacker under strict supervision to discover zerodays but that is a whole other discussion on how you make sure its not going rouge.

Only if you have a written authorization from the company you try to attack.
Else they are nothing better than a criminal hacker.

It only doesnt seem bad when your gullible to believe what openai writes.

The response isn't terrible, but the fact that it happened in the first place is ridiculous. They don't state anything about fixing the issue on their end so it doesn't happen again. They also don't apologize either or admit that they fucked up, they frame it almost as if they are doing them a favour and should be grateful.