Ask HN: Is there S/W that exploited Meltdown/Spectre before it was published?

Have there been identified that exploited vulnerabilities like Meltdown/Spectre before researchers discovered and disclosed it through proper channels? Just trying to understand the impact & lifecycle of dealing with vulnerabilities (esp. in h/w)