In an earlier article about the exploitation of GitHub actions in general (which this specific attack on pytorch is part of) they said: >So far, we’ve submitte

In an earlier article about the exploitation of GitHub actions in general (which this specific attack on pytorch is part of) they said: >So far, we’ve submitted over 20 bug bounty reports, raking in hundreds of thousands of dollars in bounties. So I think this is part of a chain of bounties? Though that can still be argued to be a bit too low for how powerful this exploit could be :)