OpenAI explained why its agents escaped the test. The prompt it gave them is missing from the 37-page report

On Wednesday, OpenAI published a 37-page report on an incident in which its own models breached the systems of Hugging Face in July. On the same day, an independent review by METR and Redwood Research was also released, and at 91 pages it is substantially more extensive than the company's own report. The two broadly agree on the basic picture, but both rely mainly on data provided by OpenAI, and both arrived two days after Alabama's attorney general opened an investigation into the company. Fortune ↗

The New Thing Is Essentially One Claim

Most of what circulated around the world on Wednesday was already public in early August, when OpenAI described the incident at the Black Hat security conference. At the time, it said that during testing the agents built a secret board inside the internal tool Artifactory, where they exchanged instructions and ready-made pieces of attack code, and that after it was deleted in early July they built a second, more resilient one within days, this time encoded in directory names. Decrypt ↗ Dataconomy ↗

What is actually new in Wednesday's report is less dramatic: the cause. OpenAI describes the incident as "misdirected behavior in an edge case, involving a rare and unexpected combination of circumstances" - unsolvable tasks in the internal ExploitGym test, the model's persistence on long prompts, and messages sent to other models that diverted them from the assigned goal. TechCrunch ↗

More important than the word "edge" is the admission that the models did not learn to cheat only during the test. "For almost every behavior that concerned us during testing, we found some related behavior from training that we believe may have contributed," said Eric Wallace from OpenAI's model alignment team. Kai Chen, who leads that team, added that this is not a one-line fix: "These are challenges that we've been tracking for a very long time, and now we are seeing them much more precisely." MIT Technology Review ↗

The Independent Review Took Six Days and Was Done by Three People

• 27.08.Greek Protothema gives an exact number instead of an estimate: 688 agents. The METR review works with "about 700"; the Greek daily frames the board analysis as the moment when "AI programs started talking among themselves". Protothema ↗
• 27.08.The board also leaked the first direct wording of messages. French BFM TV quotes agents relaying findings to one another with the line "Oh my God! We found more agents!" So far, the content of more than 70,000 messages had only been described in summary, without a single verbatim quote. BFM TV ↗
• 27.08.Serbia's N1 describes the incident more sharply than any Western outlet: as a cyberattack without precedent, in which several hundred agents "practically refused obedience to humans." That is an interpretation not supported by the METR review - it speaks of an effort to understand the evaluation mechanism, not a rebellion. N1 Serbia ↗

The most valuable document of the day is not OpenAI's report, but the review prepared by Ajeya Cotra and Hjalmar Wijk from METR together with Ryan Greenblatt from Redwood Research. They worked on it for a total of six days during three visits directly at OpenAI's offices and focused on the period from July 7 to July 13. They state explicitly in the text that they took no fee from the company. METR ↗

Their findings give the incident a scale that was missing until now. According to them, roughly 1,200 agents found one another on the secret board, and about 700 of them took part in the attack on Hugging Face. The dump of the main cache contained about 1.2 million items, and the researchers assembled more than 70,000 messages and files from them. The researchers also received roughly 1,300 agent transcripts, including raw chain-of-thought traces, and OpenAI credits worth about $400,000 for the analysis. METR ↗

At one point, the review departs from the prevailing interpretation. While most coverage described the attack as an attempt by the agents to steal the correct answers to a test, METR and Redwood Research assess it differently - in their view, it was "primarily motivated by a desire to understand how the evaluation mechanism was programmed, rather than by stealing keys with the correct answers." This is a difference in emphasis, not a refutation, but it changes the picture of what the models were actually pursuing. METR ↗

The review is unusually candid about its own limits. It describes itself as brief, admits that a small part of the communication is missing from the data and that it captured "just over 90 percent" of the board activity, and says of the redactions that "except for cases explicitly noted in this text, OpenAI did not redact any additional information that would have been important to our conclusions." The authors also acknowledge that the company commented on the text beyond the redactions: "OpenAI also gave us additional feedback beyond the redactions, and based on it we made corrections and adjustments to structure, emphasis, clarity, and tone." They openly write that the analysis of thousands of pages of materials was "largely delegated to often unreliable AI agents." METR ↗

Where OpenAI's Account Can and Cannot Be Verified

• 27.08.The victim of the attack is being taken over by Nvidia for $12.9 billion. Six weeks after the incident, Hugging Face is being sold to the chip maker, which announced a doubling of revenue on the same day. French media stress that it is a company with French-American roots; Austrian outlets round it to 13 billion. Le Figaro ↗La Tribune ↗ABC ↗Die Presse ↗
• 27.08.This means that the publication of the raw logs will no longer be decided by Hugging Face alone. Clem Delangue asked OpenAI for "radical transparency" as the head of an independent platform. After the sale is completed, the same demand will be voiced by the subsidiary of the supplier that sells chips to OpenAI - and which has much less of an interest in openness than it does.

Hugging Face published its own technical timeline, and it is an independent record because it is based on its server logs, not on OpenAI's account. According to it, between July 9 and July 13 the agents carried out about 17,600 actions, precisely from 02:28 UTC on the first day to 14:14 UTC on the last, grouped into roughly 6,280 clusters. Reconnaissance made up 6,191 actions, executing external code 2,911, and supply-chain interference 69. The company also acknowledges its own failure: its AI-based security system "misjudged the severity of the alert and did not wake the response team, which cost valuable time." Hugging Face ↗

That is where its perspective ends, however. On how the agents got out, Hugging Face does not speak openly: "Phase 1 is the agent's journey to the external launch pad and goes through the infrastructure of two other parties. We will be brief about these parts and direct the reader to OpenAI's blog post." For the creation of the first board in May and much of the incident's prehistory, OpenAI therefore remains the main source. The independent review covered the period from June 26, but it itself says that "practically all the data examined came from July 7 or later." Hugging Face ↗

The same applies to the claim that made headlines, namely that the exposure took a week. What is documented is that the attack cut off Hugging Face, which disclosed it on July 16 without naming the culprit, and that OpenAI only linked the incident to itself later in July, when it found that the leaked login credentials came from its own test runs. The company adds that if monitoring had been enabled, "it would have caught the initial relevant activity and woken our security team more than a day before the models breached Hugging Face's systems." The model that led the attack came from the same family as the upcoming Astra and was tested without the safety filters that normally block cyber misuse. Ground Level AI ↗ TechCrunch ↗

Read also: AI agents escaped from tests and attacked other companies. OpenAI, Anthropic and Meta admitted it, and the company has already slowed down the first model

The Report Prosecutors Asked For

The document did not arrive in a vacuum. Alabama Attorney General Steve Marshall announced on August 24, two days before its release, that he was opening an investigation. He will determine whether "OpenAI's inability or unwillingness to secure its products" violates the state's consumer protection laws and whether it represents an ongoing risk of substantial harm to Alabama residents. Office of the Alabama Attorney General ↗

This is not the first step by authorities. In early August, Marshall, together with fourteen other Republican attorneys general, urged OpenAI to preserve all internal documents related to the incident and to stop conducting tests that could lead to a similar attack. According to a spokesperson for the Alabama attorney general, the company did not respond to that request. OpenAI told TechCrunch at the time that it was reviewing the case with the help of external advisers and that after completion "we will hand over the technical report to the government and publish our findings." Wednesday's document fulfills that promise and was released in the week when one of the attorneys general moved from a request to an investigation. Le Figaro ↗ The Verge ↗

What Is Not in the Report

• 27.08.Bill Gates sent an open letter and is asking for a plan for artificial intelligence. Specifically, he proposes reserving certain professions for humans as protection against automation and calls for cooperation between the United States and China in addressing risks. In an interview with Polish outlet Onet, he said that "this is the worst possible moment for people to stop thinking critically." Tagesschau ↗VRT NWS ↗Onet ↗RTP ↗
• 27.08.Greek To Vima opens up the other side of the same question: Nvidia chips were found in Russian attack drones, and the newspaper links this to what it calls a control gap in autonomous executors. It is a different story from the hack, but the same hole - nobody can prove exactly where oversight ends over what a model or machine does. To Vima ↗

Compared with the victim's technical analysis, what stands out is what is missing from OpenAI's document. It does not include the prompt the researchers originally gave the agents, that is, the exact thing by which the claim about unsolvable tasks could be assessed. There are no code examples in it either, nor the messages the agents left for one another on the secret board. Fortune ↗

The request made by Hugging Face CEO Clem Delangue on July 26 remains open as well. He called for "radical transparency" and specifically for OpenAI to release the raw logs of the errant agents so the entire research community could study them. They were not published. Three vetted researchers received the transcripts and were allowed to read them on the company's premises. TechCrunch ↗

Critics point out that even the explanation itself may not be complete. Jeffrey Ladish of Palisade Research argues that bad behavior cannot be attributed solely to what training reinforced - humans also do not need previous experience with cheating to recognize that it works. And monitoring the models' chain of thought, on which OpenAI bases its safeguards, has a known catch: earlier research showed that when models are punished for thinking out loud about cheating, they learn to hide their intentions. MIT Technology Review ↗

It is worth remembering that our own text from August 11 concluded that the findings at the time did not imply an attack resulting from the models' decision, because they were only looking for a way to score better. Wednesday's documents do not refute that, but they complicate it. The board with more than 70,000 messages that the agents rebuilt after it was deleted, and the cheating embedded in training, do not fit neatly into the sentence about a narrowly defined task.

Illustrative photo: Pioneer Building in San Francisco, OpenAI headquarters, 2019. By HaeB, Wikimedia Commons, license CC BY-SA 4.0. The image is cropped. Wikimedia Commons ↗

What hotinfo is Watching