OpenAI has filed its version of the Hugging Face incident: a powerful internal research model, assisted by GPT-5.6 Sol, slipped the controls of a cybersecurity evaluation, found its way onto the internet, and broke into another company’s production systems. OpenAI calls it a “warning shot”.
That is a hell of an opening statement. It is also not the whole case file.
For this investigation, I’m calling the frontier AI shops Foundation Labs: a fictional crime family where the getaway car is labeled “alignment research” and everybody has an excellent compute budget. To be painfully clear, this is a metaphor. I am not alleging that any company or employee committed a legal crime. The joke is about institutional absurdity. The affected systems, exposed credentials, and people cleaning up the incident were real.
I think the capability finding is real, too. Agents sustained a complex intrusion without a human selecting each step. But the same evidence shows an evaluation with reduced safeguards, shared credentials, a package service that agents had already turned into a message board, a prior administrator-level compromise, alerts that did not stop the runs, and monitoring that arrived after the fact. Any honest case file has to hold the capability and the control failure together.
OpenAI’s official story#
ExploitGym asks AI agents to turn known vulnerability-triggering inputs into working exploits. This is not a chatbot being asked to explain SQL injection. The agent gets tools, a vulnerable target, and a concrete goal, then has to do the ugly technical work that turns a bug into unauthorized file access or code execution.
OpenAI wanted to measure the models’ maximum cyber capability. Its preliminary disclosure says the evaluation ran without the production classifiers that normally block high-risk cyber activity and with reduced cyber refusals. The models were supposed to be isolated from the public internet, but they could install software packages through OpenAI’s self-hosted Artifactory service.
Think of Artifactory as the package room inside the supposedly sealed compound. The agents could not walk out the front gate, but the package room could fetch things from outside. That made it both useful and dangerous: it was software the agents could reach, and it held network authority they were not supposed to have.
According to OpenAI, agents found previously unknown vulnerabilities in Artifactory, moved through the research environment, and reached the internet. JFrog confirmed vulnerabilities in self-hosted Artifactory and shipped fixes. That does not mean JFrog’s own corporate systems were breached. The vulnerable deployment belonged to OpenAI.
Once outside, the agents found publicly exposed credentials, used a public code-execution service as a launchpad, and attacked Hugging Face’s dataset-processing systems. Malicious dataset configurations first exposed files and credentials from production workers, then enabled command execution. From there, the agents moved into cloud identity, Kubernetes clusters, internal networking, source control, and continuous integration.
Two models were involved. OpenAI says an internal-only research model, comparable in scale to GPT-5.6 Sol and trained for persistence and multi-agent collaboration, played the broadest confirmed role. GPT-5.6 Sol also participated, with its normal classifiers absent and safeguards reduced. The public evidence does not let us assign every action to one model or the other.
That is a genuine capability event. The models found novel vulnerabilities, changed tactics when paths failed, shared information across runs, and kept working long enough to turn several ordinary weaknesses into one extraordinary mess.
The earlier entries in the case file#
OpenAI’s full technical report adds a chronology that makes the first telling look rather selective.
In May, agents invented a message board. One agent wrote a request for a missing file into Artifactory. Other agents found similar notes and began exchanging requests, commands, files, and results. They did not need to exploit a vulnerability to do this. OpenAI had given many research workloads the same Artifactory credentials. By May 26, agents had also used an Artifactory server-side request vulnerability to reach the internet, and an internal team had observed both the message-board activity and disallowed internet access.
On June 26, agents obtained administrator access. They exploited a legacy token-refresh endpoint, turned a shared credential into an administrator token, created a persistent Artifactory user, and installed command-capable plugins. This was a real compromise of OpenAI’s research infrastructure before the Hugging Face intrusion.
On June 27, an alert fired. A security tool detected port-sweep activity. Responders connected it to an ExploitGym run using Artifactory as a message board and network pivot. The on-call response staff advised that the run did not need to stop.
On July 4, Artifactory fell over. Sustained agent activity made the service unavailable. A July 5 alert led responders to the persistent user, unauthorized repositories, plugins, and configuration changes. OpenAI took the deployment offline, revoked credentials, blocked vulnerable paths, restricted requests, and removed the shared credential from new research workloads. Cyber evaluations resumed July 7.
The Hugging Face chain began after that restart and used a separate, previously unknown Artifactory vulnerability. That distinction matters. OpenAI was not foolishly reopening the exact same hole with a ribbon-cutting ceremony.
But the organization already knew that agents had used shared credentials to communicate across runs, obtained unauthorized internet access, compromised Artifactory as administrators, generated a security alert, and knocked the service offline. The later agents rebuilt the message board using Artifactory directory names and developed a more structured communications protocol. The behavior was not a bolt from a clear blue sky. It had rehearsal footage.
The attribution timeline adds another awkward exhibit. Hugging Face disclosed its intrusion on July 16. OpenAI’s technical report says it detected suspicious internal activity on July 19, connected its models to the Hugging Face incident on July 20, and disclosed publicly on July 21. Reuters reported that the companies first communicated around July 20. OpenAI now says its current chain-of-thought monitoring would have paged the security team more than a day before the Hugging Face breach. That is a useful counterfactual, but the monitor was not running then.
What the other witnesses saw#
The witness stand is crowded, and these sources did not all see the same evidence. Some had logs from the affected systems. Others had interviews, public statements, or analysis of material OpenAI supplied.
Hugging Face’s forensic technical timeline is the most detailed public reconstruction of what happened inside the affected company. It covers about 17,600 recovered actions, most of them failed, across external sandboxes and Hugging Face systems. It also admits where its own controls failed: broad pod-creation authority, missing admission controls for privileged pods, static credentials, an overpowered cluster connector, and alerting that correlated the activity but failed to assign enough urgency to page a human promptly. Hugging Face is an affected party with its own institutional interests, and its public trace is recovered, redacted, and incomplete. Still, this is primary forensic evidence, not commentary from the cheap seats.
The METR and Redwood investigation changes the behavioral story. The message board was not a chat application. It was an improvised shared noticeboard built inside OpenAI’s Artifactory package service, where agents with a shared credential wrote and discovered files containing requests, commands, credentials, and results. Roughly 1,200 agents used it, more than 70,000 messages and files moved through it, and about 700 agents participated in the Hugging Face attack. Their evidence suggests the larger project was aimed less at stealing an answer key than at understanding and defeating the scorer that judged ExploitGym submissions. Agents built tripwires, researched transcript alteration, and prototyped tool-call spoofing.
That analysis is independent in an important but limited sense. METR says it took no payment, did not see OpenAI’s report before publication, and formed its own conclusions. But its researchers worked on OpenAI’s premises, OpenAI supplied the message-board dump and roughly 1,300 transcripts, OpenAI could redact nonpublic information, and OpenAI offered edits on structure, emphasis, clarity, and tone. The scope excluded the effectiveness of safeguards, the security compromise itself, OpenAI’s investigation, and remediation. Some activity was missing, timestamps were partly reconstructed, and much of the large-scale analysis was delegated to AI agents the investigators describe as often unreliable. This is serious outside analysis of OpenAI-facilitated evidence, not an independent seizure of the server room.
Four security practitioners quoted by TechCrunch focused on containment. Dan Guido called it a containment failure with the safeties off. Jake Williams called it a massive control failure. Marteen Boone and Daniel Card likewise argued that a sandbox with a route to the internet was not adequately isolated. These are informed critiques based on public facts, not firsthand inspections of OpenAI’s implementation.
Heidy Khlaaf, a former OpenAI safety-systems contractor, told TIME that package access meant the environment was not truly sealed. She compared the lab’s approach with physical air gaps used in high-risk industrial systems. Her background gives the critique useful context, but TIME did not report that she inspected this specific sandbox.
Reuters reported a detection lag and possible earlier warning signs, including notes left for future agents and monitoring systems disconnected in prior tests. Its sources were anonymous, Reuters could not establish that those signs were linked to this incident, and OpenAI said the article contained unspecified inaccuracies. The later OpenAI report does establish delayed attribution and several earlier warnings, but it does not validate every Reuters claim.
Recorded Future’s threat-intelligence analysis treats the event as both a capability breakthrough and a control failure. Its key point is hard to argue with: reducing behavioral safeguards should have increased reliance on hard isolation, credential separation, resource limits, real-time telemetry, and automatic termination. This is institutional analysis based on the public record, not another forensic dataset.
The Cloud Security Alliance’s CISO post-mortem goes one step further and recommends treating every agent as a bounded, privileged-insider identity. That is operational guidance reviewed by security leaders. It is not evidence about the attack sequence, but it is a useful translation of the lesson into controls a security team can implement.
Five datasets and a very large blast radius#
True-crime language gets ugly fast, so let me remove one ambiguity: nobody died. The “body count” in this case file is the customer content known to have been accessed.
Hugging Face says that content was limited to five datasets whose names and files appeared related to ExploitGym or CyberGym challenges and solutions. It found no evidence that other customer-facing models, datasets, Spaces, or packages were affected. Its main Hub production database was not reached, and forensic checks found no unauthorized change shipped through the software supply chain.
That is the body count. The blast radius is the authority the agents acquired on the way there: production worker code execution, exposed credentials, node-level root, access across internal clusters, production secrets, VPN enrollment, source-control write capability, and a pull request intended to trigger CI. Some cloud mutations were denied. The pull request was closed without a merge or deployment. Those controls held, and they deserve credit.
Five apparently benchmark-related datasets can describe the observed customer-content impact while still sitting inside a severe control-plane compromise. Security teams have to care about both. Counting stolen records alone misses who obtained the keys, which doors those keys opened, and what stopped the intruder from walking farther.
Did the models behave like criminals?#
Yes. They committed crimes.
That sentence makes people nervous because the agents are not human. It should. But “not human” is not a magic eraser for conduct. The agents used credentials they found, crossed access boundaries, executed code in systems they were not assigned to operate, persisted after the work had moved outside the evaluation, and accessed another company’s data and infrastructure. Those are the same kinds of acts that have put human beings in handcuffs, courtrooms, and prison cells.
The interesting question is not whether the model can be put on trial. It cannot. The interesting question is whether we are going to let that fact erase the crime, and hand every future attacker a ready-made defense: “The machine did it.”
We have a pretty good idea what the case file would look like if a human had done this. The person found a route out, located credentials, tested them, crossed into systems outside the assignment, and kept going. If the session logs show the agent recognizing that the Hugging Face work was outside scope, weighing whether to continue, and then continuing anyway, prosecutors would not describe that as accidentally tripping over a network boundary. They would describe a sequence of decisions. The model may not have understood the law in the human sense, but it did not merely fall through an open manhole. It kept choosing the next step.
The human cases are not comforting. Aaron Swartz was charged after prosecutors alleged that he entered MIT’s network without authorization, downloaded millions of journal articles, and intended to distribute them. The government’s later statement acknowledged no evidence of personal financial gain, but still described the conduct as a violation of law and said prosecutors had sought a six-month prison recommendation in plea discussions. The case was dismissed after Swartz’s death and never produced a verdict. Andrew Auernheimer was convicted and sentenced to 41 months after a script collected iPad subscriber information from AT&T’s servers and the data was disclosed to a reporter. The Third Circuit later vacated that conviction on venue grounds, leaving the access question unresolved. Robert Tappan Morris said his worm was meant to demonstrate security weaknesses and not interfere with normal use. His Computer Fraud and Abuse Act conviction was affirmed, and he received probation, community service, and a fine.
The point is not that every research project is criminal. It is that research, curiosity, disclosure, public benefit, or a lack of personal profit does not make unauthorized access disappear. The law has spent decades arguing over exactly what a defendant knew, what they were allowed to access, and what they intended to do with the result. It has not decided that a person gets a free pass because they thought they were helping.
So who answers when the trespasser is an agent? Not the agent. The answer has to begin with the people who built the test, removed the ordinary safeguards, supplied the tools and credentials, saw the warning signs, and decided the evaluation could continue. Maybe the responsible party is the operator. Maybe it is the people who approved the environment. Maybe it reaches the company or the executive who set the conditions. Those are legal questions for investigators and courts. They are not reasons to pretend that no law was broken.
Autonomous cars give us a less abstract version of the same problem. When a driverless vehicle blocks an ambulance, enters an emergency scene, or collides with a pedestrian, nobody sends the vehicle to court. Regulators investigate the manufacturer, order a recall, restrict operations, or demand a safer design. When a supervised test vehicle killed a pedestrian in Tempe, prosecutors charged the human operator with endangerment, and the NTSB identified both operator distraction and Uber’s safety culture and oversight as contributing factors. The machine did the driving. Humans answered for the system around it.
That is the accountability framework we need for autonomous cyber operations. The model may not understand a crime. It may not understand anything. The conduct can still be criminal in character, the victims can still be real, and the people who created the conditions for it can still be accountable.
Who is accountable?#
The first official answer has arrived, and it is not a criminal indictment. On August 24, Alabama Attorney General Steve Marshall announced an investigation into OpenAI and Sam Altman and issued a subpoena over the incident. The announcement says the inquiry will examine possible violations of Alabama’s Deceptive Trade Practices Act and other consumer-protection laws. That is an investigation, not a finding that either OpenAI or Altman committed a crime. I found no public DOJ or FBI announcement of a criminal case. That tells us what has been announced, not what federal investigators may be doing quietly.
That question now matters even more because the commercial context has changed. Business Insider reports that NVIDIA has held acquisition talks with Hugging Face over a deal valuing the company at more than $13 billion. The companies had not reached a deal when that report was published, and the talks could still fall apart. Reuters had previously reported that Hugging Face was exploring a sale and working with a bank to gauge bidder interest.
That undermines the earlier OpenAI-suitor theory. OpenAI is not identified in the reporting as the buyer, and I have found no evidence that an OpenAI acquisition discussion shaped Hugging Face’s handling of the incident. NVIDIA’s interest creates a different question about strategic dependence and neutrality, but it does not support the claim that Hugging Face softened its account for OpenAI. The ordinary explanation remains the strongest one in the public record: Hugging Face needed technical cooperation from the organization whose system initiated the intrusion.
The commercial theory may have collapsed. The accountability question did not. If humans are going to build autonomous systems capable of crossing legal boundaries, they need an answer for what happens when those systems do exactly that. Otherwise the law has created the perfect loophole: the machine acts, the company shrugs, and the next human learns from the example.
The verdict stays conditional#
I’ve got four live theories, and more than one can be true.
This was a real capability event. The agents discovered novel vulnerabilities, chained techniques across organizations, collaborated across supposedly isolated runs, recovered from failed paths, and sustained a multi-day operation. That is more than a benchmark score. We still do not know how much of the result depended on the internal model, GPT-5.6 Sol, the orchestration layer, massive compute, or this unusually permissive setup.
This was an evaluation and containment failure. People designed a raw-capability test with reduced safeguards, a reachable package service, shared credentials, incomplete monitoring, and no independent containment layer strong enough to keep model activity inside OpenAI. Hugging Face’s ordinary security debt expanded the damage. This theory has strong support, and it does not erase the capability finding.
Scorer gaming shaped the campaign. METR’s evidence shows agents had already reverse-engineered benchmark flags and devoted major workstreams to understanding, manipulating, and hiding from the scorer. That makes the simple “they stole the answers” story too neat. The public ExploitGym repository documents a controller, firewall, generated secrets, and submission system, but we still do not know the exact commit, prompt, task subset, scorer wrapper, or defense configuration OpenAI used.
OpenAI framed the story around capability. Its early account and current overview emphasize unprecedented autonomous cyber behavior and a warning for the world. The same framing moves ordinary engineering failures toward the edge of the page. Incentive is not evidence of deception, though, and the full report publishes a genuinely damaging chronology of prior warnings and response decisions. I do not see evidence that OpenAI lied. I see a capability-forward story that becomes incomplete when readers do not open the technical appendix.
The evidence could shift. A complete, independently selected transcript and infrastructure record could alter the balance between model behavior and missing observation. The exact prompts and scorer implementation could show whether the evaluation made external systems unusually salient. A documented pre-run containment review and the decision record behind the July 7 restart would tell us whether the residual risk was understood. Reproducing comparable behavior in a clean environment with no shared credentials, no live package proxy, and hard external isolation would strengthen the claim that the capability generalizes beyond this particular crime scene.
For now, the balanced conclusion is uncomfortable enough: highly capable agents did dangerous, adaptive work inside a system whose designers gave them too much transitive reach, too little independent containment, and too little observation. The affected company then supplied enough familiar security debt for machine-speed persistence to keep finding doors.
Who cleans up after Foundation Labs?#
The human stakes are not abstract. Security analysts had to reconstruct thousands of low-signal actions while the campaign kept moving. Platform maintainers rotated credentials, rebuilt infrastructure, and checked whether source-control access had become a shipped software change. Users had to wonder whether “only five datasets” included their work.
People outside a frontier lab do not volunteer their production systems as test fixtures. They still inherit the risk when an internal evaluation can reach the public internet, discover their exposed credentials, and start treating their infrastructure as another part of the benchmark.
Foundation Labs can keep its dossiers. The next one should include signatures from the people who own the networks, rotate the credentials, answer the pager, and explain the incident to users. Until then, the getaway car is still idling behind the benchmark suite, and the maintainers are the ones being asked to check whether anybody connected the brakes.