The RL loop inducing these drives into the models was alluded to but not fully confirmed in the Blackhat OpenAI talk as I understood it. Indeed, the speakers mentioned one of the larger cybersecurity benchmarks is what the loop was running on. Unlikely that OpenAI would be training on a public benchmark. Though then again that might have been a misscommunication in the dense talk. Perhaps there were multiple eval and training loops sharing the infrastructure.
In any case, a plausible scenario is that the mematic spread happende purely through the message board. As the messages were placed in a way where they could have been discovered by accident in regular usage of the package mirror. Specifically through search for/enumeration of package names.
I think this will likely be the common process very soon. There is one thing missing though, namely the context of the implementor.
Historically, a human reviewer did not fix the issues they found because they missed two key pieces of information. Intricate understanding of the code changes just made, and the context for why the changes were made in the way they were.
The first one is a non-issue with todays coding agents. The second one however has not been resolved (yet). Think “why did a certain UI element get layed out like this”, “why does the data API have this weird edge case for one customer”, etc. The reasoning on these changes often lives in ticket (comments), email, slack, informal conversations. A code review agent does not have access to this information, it can’t be inferred from code alone. Only the author and their agent have it.
I suppose common pratice will become to track coding agent traces for each PR in version control. Once that is the standard I also believe that reviewer (agents) will fix issues they find on the spot.