If you read the article, you will see this was within the acceptable scope listed on OAI's bug bounty program.