“…checked [an API key] into GitHub…”

Ouch. But who hasn’t?

“Elez removed the key from his GitHub but the key itself was not revoked, allowing continued access to the AI models.”

Okay, that’s deeply bad…Maybe has no idea how API keys, or the Internet works…? Definitely lacks security advisors (or has them and ignored them).