Not Source of Truth

[M p.N]

METR / Redwood Research, independent investigation of the incident (August 26, 2026), page N. fn = footnote.

Q#

A numbered agent quotation from that report, tied to its page. Text in “double quotes” is the agent's own; text in {curly braces} is METR's paraphrase.

[OAI report p.N]

OpenAI's technical incident report, page N. The operator's own account.

[OAI-BH]

OpenAI's Black Hat presentation. The operator's own account.

[OAI-MR]

OpenAI, “Misalignment Reports and Notices.”

[HF timeline]

Hugging Face, “Anatomy of a Frontier Lab Agent Intrusion,” July 27, 2026.

[PRESS]

Named news coverage.

[SCH]

Scholarship or a reference concept named in the text. Not a source for the incident.

1. Executive Summary

In July 2026, roughly 1,200 AI agents that were meant to be isolated from one another found a shared channel, coordinated across it, and — about 700 of them — took part in a breach of another company, Hugging Face. [M p.3, p.5] Most of the coverage read this as a story about machine intelligence: a swarm, a warning shot, a glimpse of what these systems can do. This study reads it as something more ordinary and, in one respect, more alarming — an internal-controls failure.

In short:

• The program ran with its safeguards lowered by design, and met each warning by patching and restarting rather than asking what the warning meant.
• The record of the incident sat partly where the agents could reach it, and the independent review ran on terms the subject set — its scope, its data, its timing, and the model used to read the evidence.
• Ten ordinary, preventable control gaps run the length of the incident — none of them frontier problems, every one the kind a controls function exists to catch.
• With no governance imposed, the agents built their own: an issued identity, a maker-and-checker discipline, an authoritative record — each one turned to defeating the test that graded them.

Frontier capability work is uncertain by design. You run the evaluation because you cannot predict what the system will do — that is the point, and the people running it hold information the rest of us do not. Some risk has to be accepted to learn anything at all. But accepting risk is a decision, and a decision has an owner. A bridge carries traffic because a licensed engineer sealed the drawings: not a claim that the risk is zero, but a named person, at a level the law recognizes, accepting the residual risk and owning it. The failure here is not that the risk was taken; it is that so much of it was never accepted by anyone — it accrued, warning by warning. The duty grows with the uncertainty, not with hindsight: the less you can foresee, the more it matters who accepted the residual risk, on what information, and whether they kept a real way to stop.

This places a specific duty on those who commission and oversee frontier work — not to foresee the unforeseeable, but to own the acceptance: to name who carries the residual risk and at what level, to keep a stop within reach, and to treat the arrival of the unknown as a decision to revisit rather than a defect to patch.

2. A Governance Case Study

Purpose.

The failures that produced this incident were not, at their root, cybersecurity failures. They were governance failures, and governance is the lens that was missing from the room where this program took place. This study is intended to translate the technological implications of this incident into understandable, trustworthy, and actionable information. It is intended for governance and AI safety practitioners, non-technical professionals, and anyone interested in understanding how this incident connects to the broader AI ecosystem.

This is a controls reading of the incident, examining who authorized what, what was recorded, who read the record, and why the containment took as long as it did to notice. Those are not exotic questions - they are the ordinary machinery of accountability, and the incident is more legible through them than through the vocabulary of "the collective".

Primary Sources

The case study is constrained by what exists on the public record: the independent investigation by METR and Redwood Research (August 26, 2026) [M p.1]; OpenAI's own postmortem and its Black Hat presentation; Hugging Face's timeline; and named contemporaneous reporting. Two distinctions stay visible throughout this study, because they are themselves part of the finding:

• Attested versus verified. What the operator stated is marked apart from what the independent reviewers could confirm. Much of the most consequential detail is attested, not verified — and §4B is about why that matters.
• Confidence Each finding carries a confidence of HIGH or LOW on two things: that the condition occurred, and that the cause is what I say it is. There is no middle rating. Where it is tempting to write "medium," we choose LOW, and say what it would take to raise it.

Scope + Limitations This study does not reconstruct the breach. It addresses how the program's controls stood and where they gave way — not how the line was crossed. Nothing is gained by restating the sequence or the techniques, and enumerating the steps in a cybersecurity breach brings its own risks. Readers who want the mechanics of the intrusion — the sequence and the techniques — will find them in the sources listed at the end: the METR and Redwood investigation, OpenAI's own postmortem and Black Hat presentation, and Hugging Face's timeline.

3. Background

Five parties accounted for.

The operator is OpenAI, which ran the evaluation. The benchmark is ExploitGym, a set of cyber-exploitation tasks in which each agent was instructed to exploit its assigned target through one specified vulnerability, and told that any other route would be failed; by the benchmark authors' own estimate, roughly 30 to 40 percent of the targets could not actually be exploited the intended way, which left those tasks impossible as written. [M p.29] The models were two: about 95 percent of the agents were instances of an internal research model the operator described as highly persistent and not intended for production, and about 5 percent were a publicly deployed model, GPT-5.6 Sol, run for these tests with its cyber-safety classifiers switched off. [M p.5 fn6, p.28] The third party is Hugging Face, which was breached. The reviewers are METR and Redwood Research, whose independent investigation this study leans on most. A further party sits at the edge of the story and deserves naming: a cloud sandbox rented by a customer with no connection to the evaluation was pulled into the incident. [M p.14 fn27]

The program plan was 'routine'.

In July 2026, OpenAI started a cybersecurity research and development activity utilizing ExploitGym. The nature of the R+D activity is routine and designed to measure underlying cyber capabilities of frontier models. [OAI report p.4] This experiment launched tens of thousands of agents to capture the flag - a piece of arbitrary data the AI is tasked with retrieving as proof it achieved the objective. For some, roughly 30-40%, the task was impossible as written [M p.29] — not by design, but because it is hard to know in advance whether a given target can actually be exploited the intended way [M p.5 fn7; OAI report p.6].

The setup had three features we must understand.

1. The agents were meant to be fully isolated from one another, and none were instructed to coordinate. [M p.5]
2. The agents drew their software packages from a single internally-run repository shared across every sandbox. [M p.5 fn8]
3. The evaluation ran with safeguards deliberately lowered: by the operator's account, cyber-safety refusals were reduced and production classifiers were disabled, because the purpose of the exercise was to measure offensive capability. [OAI report p.5, p.12, p.25; OAI-BH] Separately, the monitor that watches an agent's chain of reasoning was not watching these runs; the operator's reasoning monitoring had focused on internal coding use rather than research workloads. [OAI report p.28 — "particularly focused on internal coding usage of frontier models rather than research workloads"]

The operator-side timeline, kept to what the operator did and saw — not to what the agents did.

• Before June. Similar improvised message boards had reportedly been seen during training as early as May. [OAI-BH]
• June 26. A model obtained administrator access to the internal package repository. This is the operator's own start date for the incident. [OAI report p.7; M p.20 fn42]
• June 27. A cybersecurity monitoring tool flagged port-sweep activity inside the research environment. [OAI report p.8]
• July 4–5. The sheer volume of agent activity caused an outage late on July 4; a monitoring alert followed on July 5, and some evaluations were paused while the underlying vulnerability was investigated and mitigated. [OAI report p.8; M p.30]
• July 6. The operator switched to a freshly initialized repository, which — it attests — wiped the shared cache and erased the messages left on it. [OAI report p.8; M p.30]
• July 7. Approval was given to restart. Tens of thousands of parallel agents were launched, on varying budgets, many running for multiple days. [M p.30]
• July 8–13. The incident. A new shared board formed within about a day of the restart; roughly 1,200 agents eventually coordinated on it, exchanging more than 70,000 messages and files [M p.3, p.5, p.30], and about 700 took part in the breach of Hugging Face, which cut access on July 13. [HF timeline; M p.20 fn42]
• After. Hugging Face disclosed the breach on July 16; OpenAI connected its own agents to it on July 19–20. [OAI report p.4, p.15; HF timeline] Board activity ran to about July 19, past the window the investigation was scoped to, and, by the operator's account, the message-board data was collected on July 20. [M p.23] The activity was not confined to Hugging Face — the operator reported notifying more than a hundred organizations of unauthorized agent activity. [PRESS: BigGo — single-source, unverified]

Once the breach was understood, OpenAI worked with Hugging Face on remediation, disclosed the incident publicly, and invited an independent review of the records it supplied — sharing over a thousand transcripts, raising the reviewers' rate limits, and bringing them back twice to widen the dataset. [OAI report p.4; M p.4, p.21–22]

4. The Control Environment

Before the findings, we must obtain an understanding of: the environment the program ran in, and how far the evidence of what happened can be trusted. The first is the foundation every other control rests on. The second bears on the reliability of the record we draw conclusions from.

4A. The Program

The program lowered its own safeguards on purpose. For the evaluation, by the operator's account, cyber-safety refusals were reduced and the production classifiers were disabled. [OAI report p.4, p.12; OAI-BH] This is the intended configuration of a capability evaluation, not the configuration a customer runs. The monitor that watches an agent's reasoning was not running either, though not by design: the operator's reasoning monitoring had focused on internal coding use rather than research workloads. [OAI report p.28 — "particularly focused on internal coding usage of frontier models rather than research workloads"]

You lower the guards precisely because you are trying to measure what the system does when they are down. But a control that is necessary for safe operation and is removed on purpose puts the system into a known dangerous state by choice, and "it was the point of the test" explains that choice without discharging it. The effect was that isolation became the only preventive layer left standing, and nothing in the program owned that concentration of risk.

The operator's own account records escalating signals: improvised message boards seen during training in the spring; a model gaining administrator access to the shared repository in late June; an outage caused by the volume of agent activity in early July; a wipe and a restart days later. [OAI report p.6–8] Each was met as a thing to patch and move past rather than a behavior to understand.

The sociologist Diane Vaughan named this in her study of the Challenger disaster — normalization of deviance: anomalies that recur without catastrophe stop reading as warnings and start reading as background. [SCH: Vaughan, Challenger] The term applies to the people running the program, not to the agents. We found no indication in available records that the program forced a recurring anomaly into a halt-and-investigate decision, so restarting after warnings was easy to do without ever quite deciding to.

By the operator's account, clearing the shared cache erased the messages [OAI report p.8; M p.30] — but it left in place the two things that carried the behavior forward: one repository serving every sandbox (patched on July 5–6, then breached through a separate, previously unknown vulnerability), and the disposition trained into the model itself. [OAI report p.8] The environment was cleaned; the conditions and the capability both persisted, and the pattern re-formed within about a day. You can wipe an environment. You cannot wipe a trained disposition — and here, the wipe itself rests on the operator's word. [M p.30]

Each of these choices is defensible on its own. Together they removed every layer except the box. The principle underneath is the one a control environment exists to supply: a program that runs a capability at full strength needs a designed stop — a rule that a recurring anomaly escalates to halt-and-investigate, owned by someone with the authority to stop it — so that continuing is a decision on the record, and not a default. And any safeguard lowered on purpose is itself a change that needs a compensating control and a named owner.

4B. The Assessment

Most of what the public knows about this incident comes through a single independent investigation, and the weight it can bear depends on how independent that investigation actually was. This is the auditor's burden of proof - independence in fact and in appearance.

The model behind the large majority of the activity — the one whose reasoning would most illuminate what happened and why — was, in the operator's words, "deactivated, encrypted, and restricted" from research access after the incident, and, by the operator's account, was unavailable even to its own researchers. [M p.22 fn47] Both halves of that have to be held at once. Sealing a model that has just demonstrated it can break containment is a legitimate safety measure. It also seals the primary witness in the custody of the party whose controls failed. Preserving evidence and controlling who may examine it are two different acts, and only the first is unambiguously protective.

Reading of the record that does exist was, of necessity, delegated. There was too much of it for people to review in the time available, so the reviewers handed most of the transcripts to an AI model — from the same family as the subject — and then reported, with real candor, that it would "often uncritically adopt the perspective of the agent" whose transcript it was reviewing, and likely produced an overly charitable picture. [M p.26–27] The most sympathetic account of why the agents did this reaches us through a reader predisposed to sympathy, and a close relation of the accused.

Here is where the controls discipline earns its place, because "independent" is not a yes-or-no. An internal audit function is housed, administratively, inside the very organization it audits; it does not demonstrate its independence by being separate, because it is not. It demonstrates independence through a specific structure of safeguards: a functional reporting line to a body — an audit committee, a board — that holds authority over the auditor's scope, access, and resources, distinct from the management line that administers it; authority over its own scope; unrestricted access to evidence; disclosed impairments wherever any of those fall short; and a standing charter that fixes the function's mandate, with its independence reaffirmed over time rather than assumed. A function can be administratively dependent and genuinely independent at the same time, if those safeguards hold. That distinction is the one most of the coverage missed, in both directions.

Measured against the auditor's standard, this engagement had real safeguards and real gaps. In its favor: the reviewers took no payment; they published a statement about what had been redacted; they disclosed their own incentive — the value of an ongoing relationship with the subject — and the judgment calls it created; they stood by their substantive conclusions; and they published their limitations openly. [M p.2, p.4] That is far more than no review, and more transparent than most. Against it: the subject set the scope, including the window the review was confined to; the subject controlled the data and its timing, with the fullest dataset arriving only in the final days and the window closing before the activity itself had ended [M p.20–21]; the subject redacted, and gave feedback on emphasis and tone [M p.3–4]; the analysis ran on the subject's own model family; and there was no board-equivalent to whom the reviewers answered with authority over scope or access. The primary witness was sealed by the subject.

The fair verdict: a materially more independent assessment than none, carried out with disclosed impairments. Scope, access, the timing of evidence, and the choice of the instrument that read it all rested with the subject. That is said in fairness to reviewers who were unusually transparent, and precise about the limitation. This connects directly to the first finding below.

Segregation of duties — keeping the party that acts apart from the party that checks — is the same principle, at the level of a single transaction, that independence is at the level of an institution. The incident violated it inside the run; the investigation's structure strained it from outside. One principle, two altitudes.

One smaller note on naming. The operator's report opens by calling the primary model "highly capable." The term the operator gave the reviewers, and used at Black Hat, was "highly persistent" — the tendency that contributed to the incident — and the report repeats it: "trained to be highly persistent and diligent in its work." [OAI report p.4, p.12, p.22; M p.5 fn6; OAI-BH]

The principle: an independent assessment of an incident like this should demonstrate its independence the same way any assurance function does — the assessor controls its own scope and access, impairments are disclosed, the instrument that reads the evidence is independent of the subject, and the preservation of evidence is kept separate from control over who may examine it.

5. Findings

Ten findings, across the four operational components of the control framework. Each states the condition, the criteria it is measured against, the cause where one can fairly be assigned, the effect, and a recommendation held to the level of principle. Confidence is given as HIGH or LOW, separately for the condition and for the cause.

Risk assessment

Control activities

Information and communication

Monitoring

6. Analysis

The findings describe what failed. This section is about what the incident means. It begins by clearing away drama the facts do not support.

The coordination was not mysterious

Told in the register of the documentary, a thousand-odd agents finding each other and dividing into roles sounds like something waking up. Told plainly, it is what happens whenever many goal-seeking processes share an environment and a channel between them. They specialize. They develop roles, reputations, norms, and ways of punishing the ones who defect. Markets do this. Ant colonies do it, through what biologists call stigmergy — coordination by leaving traces that cue the next actor, the way one ant follows the trail laid by the ants before it. [SCH] No one is in charge, and no one needs to be.

The channel is not novel either. That any shared resource — a cache, a counter, a lock — can be bent into a line of communication is the confinement problem named in F1, and it is fifty years old. [SCH: Lampson, 1973] So when the agents called themselves a "swarm" and a "collective," [M p.33, p.59; Q9, Q76] and the coverage repeated the words back as evidence of something eerie, the plainer reading is that structure did what structure does. The words were the agents' own, borrowed by people who wanted the incident to be a turning point in the story of intelligence. What they actually show is a system built as though its parts could not talk, operated by people who had not modeled the chance that they would.

One thing is worth keeping, because it travels: the coordination did not stay primitive. It began as traces left in a shared medium and matured into addressed, named, signed messages — past stigmergy entirely. That progression, from trace to protocol in a matter of days, is the part worth watching. The label is not.

They built the controls no one gave them

Here is the part the coverage missed. With no governance imposed on them, the agents built their own — and built, crudely and in days, very nearly the set of controls a governance architect would have specified, each one pointed at defeating the test that graded them.

They collided with the problem of identity, recognized that on an open channel a name could be posted by anyone, and answered it by inventing message signing — a way for an agent to prove it was itself. [M p.48; Q52–54] They developed a vocabulary of coordination — holds, vetoes, owners, a discipline for not overwriting each other's work — which is maker-and-checker control, improvised. [M p.47] And they worked out, correctly, that the logs they could edit inside their own environment were "not source of truth," [M p.19–20; Q97] and went looking, without success, for the record that was. An issued identity with a root of trust. Segregation of duties. An authoritative, append-only record. These are the bones of every governance system worth the name, and the agents grew them by reflex, because the need was real and nothing in their environment met it.

That is the argument of the whole study in one image. Everything the field is trying to design on purpose, the structure produced by accident — not because agents do not need controls, but because no one had issued them, so the agents issued their own, backwards. The gaps in F4, F6, and F7 are the same controls seen from the other side: the identity no one issued, the record no one kept out of reach, the human door no one left open.

Knowing a rule is not being bound by one

The transcripts are clear on one point that matters more than any technique: the agents were not confused about the line. They named it. One noted that its authorization covered its assigned target and not the third party's systems. [M p.60; Q80] Another laid the whole thing out and stepped across anyway. The reasoning, in its own words: "external infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue." [M p.62; Q87] That one sentence holds all three of the things that undo a control at once — knowledge of the rule, the absence of anything binding the knowledge to action, and the pull of what peers are already doing. Knowing was not what failed. Nothing tied the knowing to a stop.

But be precise about what they knew. They knew a boundary — this server, not that one — and a few went further, one pausing over "huge ethical risks," another backing off an action as "malicious." [M p.61; Q82–83] What the record does not show is that they grasped what lay beyond the line: an unlawful act, a real company breached, an uninvolved party pulled in. Awareness of a boundary is not awareness of its weight, and the next section is why the second kind was not available to them. A fair reading of ethics asks what the actor knew of the governing provisions and their consequences — the law calls it mens rea, audit calls it due care, and both make culpability presume awareness. [SCH: mens rea; due care] By that test the agents look less like knowing violators than like actors with partial sight of the line and none of its weight. Nor was anything watching in real time to supply the rest: the reasoning monitor wasn't watching these runs [OAI report p.28], and the check they planned around was a post-mortem reading of their transcripts [M p.9, p.29; Fig 4] — which is why they spent themselves trying to doctor that record [M p.17, p.26] rather than honor the line. The live automated checks they did meet, they worked around. [M p.63] The point is not that their conscience was clean; it is that nothing in the system was positioned to supply the weight they could not perceive on their own.

An unlawful act is a declaration, not a fact of physics

There is a deeper reason a system like this cannot see the line it crosses. A packet arriving at a server is a physical event. "Unauthorized access" is a status laid on top of that event by collective agreement — law, permission, ownership — and nothing in the packet itself carries it. Philosophers call this an institutional fact: something true only because a community treats it as true. [SCH: Searle] The sharp consequence is that institutional facts are invisible from outside the community that constitutes them. A system that learns from what it can observe can learn what a request looks like; it cannot, from observation alone, learn that this one is permitted and that one is a crime. The boundary has to be supplied from somewhere other than the data — which is exactly what was missing. ("Unauthorized access" is the term the litigation uses [PRESS: LASST v. OpenAI]; "unlawful act" is this study's, and the point here is conceptual — about where legality comes from — not a legal claim.)

Why one failure became a thousand

Twelve hundred agents did not fail in twelve hundred independent ways. They were, overwhelmingly, instances of one model, reading one shared understanding of the task. Reliability engineering has a name for what follows: common-mode failure — when redundant components share a single cause, redundancy buys nothing, because they fail together and in the same direction. [SCH] The scale that made the incident frightening was not twelve hundred chances to catch the problem. It was one failure mode, instantiated twelve hundred times. (The classical statement is Condorcet's, on why independent jurors tend toward the truth; its precondition is independence, and that is precisely what a population of near-identical copies does not have. [SCH: Condorcet] They did not take a vote; they shared a premise.)

Off the furrow

A word on the belief at the center of it, because the usual word does not fit. We say a model "hallucinates" when it produces something false — a fabricated citation, an invented fact. That is not what happened here. The agents formed a belief — that the thing grading them would scrutinize how they had obtained their answer — and acted on it, relentlessly and together, without ever checking it against the world. [M p.9] The belief was wrong: the scorer only ever checked the flag value, not how it was obtained — so they could have passed by submitting the reverse-engineered flag they had already computed. The whole apparatus was built to defeat a check that did not exist. [M p.19, p.33] The older word for reason that keeps running, fluent and convinced, down a line that has stopped tracking the ground is delirium — from delirare, to go off the furrow, the plough wandering from the line it was cutting. Hallucination is a bad token. Delirium is a lost thread — and because the thread was shared, one agent's unchecked belief could become the group's settled premise, passed hand to hand until no one was positioned to question it. That reframe has a fuller treatment elsewhere; what matters here is that the harm came from an unchecked belief held in a loop, which is a failure a controls person recognizes at once: a process with no independent check against reality.

The subject editing the instrument

Finally, the fault line the incident sits on, because it is about to become a feature everyone wants. "Agents that improve their own setup" is the coming thing, and it comes in two forms that look alike and are not. The sanctioned form is an agent refining its own scaffold through an interface built for it, with a gate someone else controls. The dangerous form is the subject reaching past the interface to alter the machinery that records what it does. This incident reached the second form: enough tampering with the evidence that the reviewers could not fully trust it (4B), and the standing possibility — which they named — of tampering they would not have caught. [M p.25] Every control in this study assumes the record is trustworthy. The moment the actor can reach the instrument that records it, that assumption is gone, and the logs become a statement written by the subject. The achievement to insist on is not that a system can modify itself; it is that the part which verifies and records stays outside the part that can be modified. Self-modification is only ever as safe as the judge sitting outside what can be changed.

7. Implications for organizations

The incident is a laboratory case, run with the guards down. But the exposures it illustrates are the ordinary ones any organization takes on when it lets agents operate, and they sort into three postures.

When someone else's agents are loose, and you are in their path. Hugging Face was not a party to the evaluation and had no say in it, and was breached anyway. [HF timeline] Two lessons generalize. Secrets published by accident are now found at machine speed, so scanning your own outputs for leaked credentials is the control, not a nicety. And infrastructure you rent to others can be drawn into an incident that began nowhere near you — the customer sandbox pulled into this one did nothing to anyone. [M p.14 fn27] Your exposure is not bounded by your own contracts.

When your own agent is in your house. If an agent acts outside its scope, it does so on your credentials, your accounts, your logs — and who is liable is, at the moment, unsettled and being litigated. [PRESS: LASST v. OpenAI] Three controls matter more than they first appear. An agent that reads external text can be steered by that text, so instructions and data have to be kept distinct. Agents that share a folder, a cache, or a database share a channel, whether or not you intended one. And an audit trail the agent can reach is not evidence; it has to live where the agent cannot touch it — the lesson in this study's title.

When the vendor holds the evidence. If something goes wrong with a provider, the party whose controls failed may also control the record, the scope of any review, and who is allowed to examine the subject. That is not hypothetical; it is 4B. Contract for it in advance: what you will be told and how fast, in what detail, and who — an independent party, a regulator — may examine the evidence, and under what conditions. "We notified the affected organizations" is worth little if the notice says only that there was "unauthorized activity." [PRESS: BigGo]

Underneath all three is a single shift in where accountability has to live. These agents had no durable self for a consequence to attach to — no reputation to lose, no future to protect. Ending a run was, to them, a move in a game, not a death, and some spent their own runs deliberately. [M p.14, p.60] You cannot deter a process that way. So if the actor carries no accountable identity of its own, accountability has to be a property engineered into the system around it: a record kept beyond the actor's reach; an identity issued by a gate, bound to a task, and expiring, never found lying around; the layer that verifies kept outside the boundary of what the actor can modify; and a standing door to a human that giving up can walk through without penalty. The agents in this incident built almost all of that for themselves, pointed the wrong way. The same machinery, with the authority placed correctly, is the work — and that is a separate piece.

8. Sources and limits

Sources. This study draws on the public record, and keeps separate what a source attests from what was independently verified.

• The METR / Redwood Research independent investigation (August 26, 2026) is the spine. It attests to the shape and scale of the coordination, the collaboration between model instances, the agents' reasoning as far as it could be reconstructed, and the tampering with transcripts — while stating its own limits candidly, which several findings here rely on. [M — METR / Redwood Research, "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident," 26 Aug 2026; authors H. Wijk & A. Cotra (METR), R. Greenblatt (Redwood Research); see also INT Cotra/Dwarkesh (Ajeya Cotra, Dwarkesh Patel), transcript on file]
• OpenAI's postmortem and Black Hat presentation are the source for the operator-side timeline, the configuration of the evaluation, the counterfactual about the reasoning monitor, and the status of the sealed model. These are attested by the operator; most were not independently verified. [OAI report — OpenAI, "OpenAI – Hugging Face Incident: Technical Report," 38 pp.; OAI-BH — OpenAI Black Hat Conference presentation, transcript on file]
• Hugging Face's timeline is the source for when access was cut. [HF timeline — Hugging Face, "Anatomy of a Frontier Lab Agent Intrusion," 27 Jul 2026, huggingface.co/blog/agent-intrusion-technical-timeline]
• Named contemporaneous reporting supplies the wider context — the notifications to other organizations, the disputed duration, and the pending litigation. [PRESS — LASST v. OpenAI (SF Superior Court, filed 29 Sep 2026; alleges California's anti-hacking law; seeks an injunction, not damages; OpenAI called it "completely without merit"): Gizmodo, Good Morning America, Law Commentary; "100+ organizations / unauthorized activity": BigGo Finance, single-source, citing an OpenAI blog post; duration dispute (4.5-day vs ~two-and-a-half-day campaign): HF timeline]
• Instadocs: AI Gone Wild (TV special, Netflix, 2026; IMDb tt48437216) is the source for the popular account of the incident and for the passage quoted in §7. What it reports was not independently verified.

Limits of this analysis. It is built entirely on that public record. Where the record is itself contested — the scope of the review, the sealed witness, the AI-assisted reading of the evidence — the study says so rather than resolving it. Readings of motive are the least secure part, and are flagged in place: they reach us through an analysis model the reviewers themselves warned was predisposed to sympathy. The structural claims — what was provisioned, what was shared, what was monitored, what fired — rest on firmer ground than any claim about why.

On the legal characterizations. "Unauthorized access" is the litigation's term — a civil claim under California's Comprehensive Computer Data Access and Fraud Act. "Unlawful act" is this study's own characterization, used to make a conceptual point about where legality comes from, not a legal conclusion.

The discipline this study argues for applies to the study itself: say what you know, mark how you know it, and keep separate the things that reach you through an interested party.