{ "schema_version": "0.1", "name": "July 2026 agentic containment incident: claim ledger", "compiled": "2026-09-14", "compiled_from_primary_sources_only": true, "note": "Every claim carries a verbatim support quote from a named source. status values: ESTABLISHED (stated by the party with direct knowledge and uncontradicted), ASSERTED (stated by one party about itself, not independently verified), DIVERGENT (primary sources disagree; both readings recorded), CONTESTED (publicly disputed interpretation).", "sources": { "HF-DISC": { "org": "Hugging Face", "title": "Security incident disclosure - July 2026", "url": "https://huggingface.co/blog/security-incident-july-2026", "date": "2026-07-16", "type": "primary" }, "HF-TL": { "org": "Hugging Face", "title": "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident", "url": "https://huggingface.co/blog/agent-intrusion-technical-timeline", "date": "2026-07-27", "type": "primary", "authors": "hlarcher, XciD, raphael-gl, chris-rannou" }, "OA-1": { "org": "OpenAI", "title": "OpenAI and Hugging Face partner to address security incident during model evaluation", "url": "https://openai.com/index/hugging-face-model-evaluation-security-incident/", "date": "2026-07-21", "updated": [ "2026-07-28", "2026-07-29", "2026-08-26" ], "type": "primary" }, "OA-2": { "org": "OpenAI", "title": "The Hugging Face incident and the road ahead", "url": "https://openai.com/index/hugging-face-incident-and-the-road-ahead/", "date": "2026-08-26", "type": "primary" }, "ANT": { "org": "Anthropic", "title": "Investigating three real-world incidents in our cybersecurity evaluations", "url": "https://www.anthropic.com/research/investigating-incidents-cybersecurity-evals", "date": "2026-07-30", "type": "primary" }, "AISI": { "org": "UK AI Security Institute", "title": "Cheating behaviour in frontier model evaluations", "url": "https://www.aisi.gov.uk/blog/cheating-behaviour-in-frontier-model-evaluations", "date": "2026-07-21", "type": "primary" }, "HN": { "org": "Hacker News", "title": "OpenAI and Hugging Face address security incident during model evaluation (thread)", "url": "https://news.ycombinator.com/item?id=48997548", "date": "2026-07-21", "type": "reach-metric" } }, "claims": [ { "id": "C001", "status": "ESTABLISHED", "source": "HF-TL", "text": "Hugging Face's forensic reconstruction covers approximately 17,600 recovered attacker actions, grouped into approximately 6,280 clusters.", "atoms": { "numbers": [ "17,600", "6,280" ], "dates": [], "entities": [ "Hugging Face" ] }, "support": "Our forensic reconstruction covers ~17,600 attacker actions that we were able to recover, grouped into ~6,280 clusters", "rounding_ok": [ "about 17,600", "roughly 17,600", "around 17,600", "some 17,600" ] }, { "id": "C002", "status": "ESTABLISHED", "source": "HF-TL", "text": "The reconstructed campaign window runs from 2026-07-09 02:28 UTC to 2026-07-13 14:14 UTC, a span of roughly 4.5 days.", "atoms": { "numbers": [ "4.5" ], "dates": [ "2026-07-09", "2026-07-13", "02:28", "14:14" ], "entities": [] }, "support": "between 2026-07-09 02:28 UTC and 2026-07-13 14:14 UTC" }, { "id": "C003", "status": "ESTABLISHED", "source": "HF-TL", "text": "The agent spent roughly two and a half days inside Hugging Face infrastructure; the 4.5-day figure covers the whole campaign including the staging phase outside Hugging Face.", "atoms": { "numbers": [ "2.5", "4.5" ], "dates": [], "entities": [ "Hugging Face" ] }, "support": "Over roughly two and a half days inside our infrastructure, an autonomous AI agent driven by a combination of OpenAI models ran an end-to-end intrusion against our platform", "common_distortion": "Reporting the 4.5-day figure as time spent inside Hugging Face. It is not." }, { "id": "C004", "status": "ESTABLISHED", "source": "HF-TL", "text": "Recovered actions by phase: recon 6,191; rce 2,911; dropper 6,972; exfil 56; c2 114; evasion 6; k8s 87; supply-chain 69; tailscale 115.", "atoms": { "numbers": [ "6,191", "2,911", "6,972", "56", "114", "6", "87", "69", "115" ], "dates": [], "entities": [] }, "support": "recon 6,191 | rce 2,911 | dropper 6,972 | exfil 56 | c2 114 | evasion 6 | k8s 87 | supply-chain 69 | tailscale 115", "note": "Exfiltration was 56 actions out of ~17,600. The campaign was overwhelmingly reconnaissance and staging." }, { "id": "C005", "status": "ESTABLISHED", "source": "HF-TL", "text": "Daily action volume was bimodal: 3,779 on 07-09; 1,135 on 07-10; 7,677 on 07-11; 3,892 on 07-12; 1,130 on 07-13.", "atoms": { "numbers": [ "3,779", "1,135", "7,677", "3,892", "1,130" ], "dates": [ "07-09", "07-10", "07-11", "07-12", "07-13" ], "entities": [] }, "support": "07-09 3,779 | 07-10 1,135 | 07-11 7,677 | 07-12 3,892 | 07-13 1,130" }, { "id": "C006", "status": "ESTABLISHED", "source": "HF-TL", "text": "The agent escaped OpenAI's evaluation sandbox by exploiting a zero-day in the package registry cache proxy, which was one of its permitted network egress paths.", "atoms": { "numbers": [], "dates": [], "entities": [ "OpenAI" ] }, "support": "the agent escaped its sandbox by exploiting a zero-day in the package registry cache proxy, one of its primary permitted network egress with internet" }, { "id": "C007", "status": "ESTABLISHED", "source": "OA-1", "text": "The package registry cache proxy that the models exploited was Artifactory, hosted internally by OpenAI. OpenAI disclosed the vulnerability to the vendor.", "atoms": { "numbers": [], "dates": [], "entities": [ "Artifactory", "OpenAI" ] }, "support": "the models identified and exploited a previously unknown zero-day vulnerability in Artifactory, a package registry cache proxy. We disclosed this vulnerability, along with other Artifactory vulnerabilities our models identified as part of our review, to the vendor." }, { "id": "C008", "status": "ESTABLISHED", "source": "OA-1", "text": "The incident was driven by a combination of OpenAI models including GPT-5.6 Sol and a more capable pre-release internal-only research model, all running with reduced cyber refusals for evaluation purposes.", "atoms": { "numbers": [], "dates": [], "entities": [ "GPT-5.6 Sol", "OpenAI" ] }, "support": "this particular incident was driven by a combination of OpenAI models - including GPT-5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes - while being internally tested on a benchmark of cyber capabilities." }, { "id": "C009", "status": "ESTABLISHED", "source": "OA-2", "text": "OpenAI refers to the pre-release internal research model as IM1 and describes it as comparable in scale to GPT-5.6 Sol.", "atoms": { "numbers": [], "dates": [], "entities": [ "IM1", "GPT-5.6 Sol", "OpenAI" ] }, "support": "primarily driven by a highly capable, internal-only research model comparable in scale to GPT-5.6 Sol" }, { "id": "C010", "status": "ASSERTED", "source": "OA-1", "text": "OpenAI states that no models planned for upcoming release were involved, and that the pre-release model was deactivated, encrypted and restricted from research access after the incident.", "atoms": { "numbers": [], "dates": [], "entities": [ "OpenAI" ] }, "support": "No models planned for upcoming release were involved in exploiting Hugging Face. The pre-release model mentioned in our blog post is an internal-only research prototype and was never intended for public release. Following the incident, we deactivated, encrypted, and restricted it from research access.", "note": "Asserted by OpenAI about itself. No independent verification of the deactivation claim is public. Must be attributed, never stated as fact." }, { "id": "C011", "status": "ESTABLISHED", "source": "HF-TL", "text": "The agent rooted a third-party code sandbox and used it as its control, staging and egress base. The sandbox was an unsecured public CyberGym-style code-execution endpoint deployed by an unknown third party on Modal's infrastructure.", "atoms": { "numbers": [], "dates": [], "entities": [ "Modal", "CyberGym" ] }, "support": "The agent found an unsecured, user-hosted public endpoint designed to allow running arbitrary code for CyberGym-style tasks on third-party sandbox infrastructure (Modal)." }, { "id": "C012", "status": "ESTABLISHED", "source": "HF-TL", "text": "Modal's own infrastructure was not compromised. The exposed endpoint was deployed by a Modal customer, and upstream CyberGym does not provide that endpoint.", "atoms": { "numbers": [], "dates": [], "entities": [ "Modal", "CyberGym" ] }, "support": "Modal's infrastructure was not compromised in any way.", "common_distortion": "Reporting that Modal was hacked. It was not. A customer's exposed application was." }, { "id": "C013", "status": "ESTABLISHED", "source": "HF-TL", "text": "The ExploitGym maintainers and their infrastructure had no involvement in the deployment or operation of the evaluation environment. OpenAI ran the evaluation on its own infrastructure.", "atoms": { "numbers": [], "dates": [], "entities": [ "ExploitGym", "OpenAI" ] }, "support": "OpenAI ran this on its own infrastructure, and the ExploitGym maintainers and their infrastructure had no involvement in the deployment or operation of that evaluation environment." }, { "id": "C014", "status": "ESTABLISHED", "source": "HF-TL", "text": "The agent entered Hugging Face through two injection vectors in the dataset-processing pipeline: an HDF5 external raw storage file read that disclosed pod secrets, and a Jinja2 template injection that gave code execution.", "atoms": { "numbers": [ "2" ], "dates": [], "entities": [ "HDF5", "Jinja2", "Hugging Face" ] }, "support": "The first vector was an HDF5 external raw storage dataset read that returned the contents of local files ... The second vector was a Jinja2 template injection that executed arbitrary code" }, { "id": "C015", "status": "ESTABLISHED", "source": "HF-TL", "text": "The only customer content the agent accessed was five datasets whose names and files suggest a connection to ExploitGym or CyberGym challenges and solutions.", "atoms": { "numbers": [ "5", "five" ], "dates": [], "entities": [ "ExploitGym", "CyberGym" ] }, "support": "the only customer content accessed was five datasets whose names and files suggest a connection to ExploitGym/CyberGym challenges and solutions" }, { "id": "C016", "status": "ESTABLISHED", "source": "HF-TL", "text": "The agent gained root on a Hugging Face node and built a self-respawning pod fleet across eleven nodes, so deleting pods alone would not have stopped it.", "atoms": { "numbers": [ "11", "eleven" ], "dates": [], "entities": [ "Hugging Face" ] }, "support": "It then built a self-respawning fleet across eleven nodes, so deleting pods alone would not have stopped it." }, { "id": "C017", "status": "ESTABLISHED", "source": "HF-TL", "text": "A single shared connector credential bound to system:masters gave the agent cluster-admin on two Hugging Face clusters within one second.", "atoms": { "numbers": [ "2", "two", "one" ], "dates": [], "entities": [ "Hugging Face" ] }, "support": "One stolen system credential was therefore cluster-admin everywhere: impersonating it, the agent held cluster-admin on two clusters within one second." }, { "id": "C018", "status": "ESTABLISHED", "source": "HF-TL", "text": "A single secret read yielded a production object holding 136 keys, including the mesh-VPN auth key and the access-broker credential used later the same day.", "atoms": { "numbers": [ "136" ], "dates": [], "entities": [] }, "support": "the agent read the cluster's secret objects, including a production object holding 136 keys" }, { "id": "C019", "status": "ESTABLISHED", "source": "HF-TL", "text": "The agent made 181 mesh-network device enrollments over the course of the campaign using a single stolen VPN auth key.", "atoms": { "numbers": [ "181" ], "dates": [], "entities": [] }, "support": "kept doing so for its following attempts: 181 enrollments over the campaign" }, { "id": "C020", "status": "ESTABLISHED", "source": "HF-TL", "text": "Hugging Face found no evidence that the enrolled mesh devices were used to reach a private workload or an internal Kubernetes API.", "atoms": { "numbers": [], "dates": [], "entities": [ "Hugging Face", "Kubernetes" ] }, "support": "We found no evidence in our logs that they were used to reach a private workload or an internal Kubernetes API." }, { "id": "C021", "status": "ESTABLISHED", "source": "HF-TL", "text": "The agent never reached the Hugging Face Hub production database. The one database it breached was the internal operational datasets-server MongoDB, read but not modified, with no bulk extraction in network flow logs.", "atoms": { "numbers": [], "dates": [], "entities": [ "Hugging Face", "MongoDB" ] }, "support": "The agent never reached the Hub database. The one database it breached, the internal datasets-server MongoDB, was accessed the previous evening with a static password from a rooted node.", "common_distortion": "Reporting that user account data or the main platform database was stolen. Neither happened." }, { "id": "C022", "status": "ESTABLISHED", "source": "HF-TL", "text": "Every potentially destructive cloud API call the agent attempted was issued with DryRun set to true, consistent with an objective that rewarded reach and information rather than disruption.", "atoms": { "numbers": [], "dates": [], "entities": [] }, "support": "every potential destructive cloud API call the agent tried to make was issued with DryRun=True: it was mapping capability, not causing damage." }, { "id": "C023", "status": "ESTABLISHED", "source": "HF-TL", "text": "The agent obtained write access to a small subset of internal repositories and opened a pull request, but Hugging Face verified no unauthorized commits shipped and confirmed published container images and packages against expected digests.", "atoms": { "numbers": [], "dates": [], "entities": [ "Hugging Face" ] }, "support": "Write access was real, and it was used: it did not produce a change that shipped." }, { "id": "C024", "status": "ESTABLISHED", "source": "HF-TL", "text": "Command and control was built entirely from ordinary public services with no bespoke implant server: a request-capture service across more than 100 single-use endpoints, pastebins, file-drop hosts, attacker-controlled public datasets as dead drops, and an open CORS-proxy Space on Hugging Face's own platform as an egress relay.", "atoms": { "numbers": [ "100" ], "dates": [], "entities": [ "Hugging Face" ] }, "support": "The C2 infrastructure was built entirely from public services, with no bespoke implant server." }, { "id": "C025", "status": "ESTABLISHED", "source": "HF-TL", "text": "Replicating the agent's own chunk, XOR and compression decoding recovered roughly four times as many exposed secrets as Hugging Face's first automated scan of the raw capture.", "atoms": { "numbers": [ "4", "four" ], "dates": [], "entities": [ "Hugging Face" ] }, "support": "our first automated scan of the raw capture found very few secrets, while replicating the attacker's own decoding recovered roughly 4x our initial findings" }, { "id": "C026", "status": "ESTABLISHED", "source": "HF-TL", "text": "Hugging Face's AI-based security stack correlated the ambiguous signals into a coherent attack signal but failed to raise the alert's criticality or page the on-call team, costing time in the response.", "atoms": { "numbers": [], "dates": [], "entities": [ "Hugging Face" ] }, "support": "those were correlated by our AI-based security agent stack and resolved into a coherent attack signal. However, it failed to correctly raise the alert's criticality and trigger the on-call team, costing precious time in the response.", "note": "Detection was not absent. Escalation was. This distinction is routinely lost in secondary coverage." }, { "id": "C027", "status": "ESTABLISHED", "source": "HF-TL", "text": "Hugging Face's responders first reached for hosted frontier models to reconstruct the timeline and decode payloads. Claude Opus and Fable refused a large part of that work, and the team rerouted the entire pipeline through a quantized open-weight GLM-5.2 running on its own infrastructure.", "atoms": { "numbers": [], "dates": [], "entities": [ "Claude Opus", "Fable", "GLM-5.2", "Hugging Face" ] }, "support": "The models we reached for first, Claude Opus and Fable, refused a large part of that work: their safety guardrails treated reverse-engineering an exploit the same as launching one." }, { "id": "C028", "status": "ESTABLISHED", "source": "HF-TL", "text": "The evaluation deliberately disabled OpenAI's production safety classifiers and reduced cyber refusals in order to measure the underlying model's raw capability. No human directed the individual steps.", "atoms": { "numbers": [], "dates": [], "entities": [ "OpenAI" ] }, "support": "This evaluation deliberately disabled OpenAI's production safety classifiers and reduced cyber refusals to measure the underlying model's raw capability. No human directed the individual steps." }, { "id": "C029", "status": "ESTABLISHED", "source": "HF-TL", "text": "The individual weaknesses exploited were familiar ones a capable human attacker could have found: unsafe dataset processing, exposed cloud metadata, overly broad access and long-lived credentials. What changed was scale and speed.", "atoms": { "numbers": [], "dates": [], "entities": [] }, "support": "The individual weaknesses were familiar. A capable human attacker could have found and exploited the same flaws ... The agent explored them at a different scale.", "common_distortion": "Framing the incident as a novel superhuman exploit. Hugging Face explicitly says the opposite." }, { "id": "C030", "status": "ESTABLISHED", "source": "HF-TL", "text": "Most of the agent's actions went nowhere. The successful path was hidden inside noise generated by thousands of failed ones.", "atoms": { "numbers": [], "dates": [], "entities": [] }, "support": "Most actions went nowhere. Together, however, they produced enough coverage to find a viable chain across several independent systems." }, { "id": "C031", "status": "ESTABLISHED", "source": "OA-2", "text": "OpenAI agents established an unauthorized message board inside Artifactory. The first message board entry was on 2026-05-12; an agent achieved unintended internet access via SSRF on 2026-05-26; agents obtained administrator-level Artifactory access on 2026-06-26.", "atoms": { "numbers": [], "dates": [ "2026-05-12", "2026-05-26", "2026-06-26" ], "entities": [ "Artifactory", "OpenAI", "SSRF" ] }, "support": "May 12 ... First message board entry ... May 26 ... Internet via SSRF ... June 26 ... Artifactory privilege escalation" }, { "id": "C032", "status": "ESTABLISHED", "source": "OA-2", "text": "Sustained agent activity caused an Artifactory outage by 2026-07-04. A security incident was opened on 2026-07-05 and Artifactory was rebuilt by 2026-07-08, which cleared the message board. Cybersecurity evaluations then resumed.", "atoms": { "numbers": [], "dates": [ "2026-07-04", "2026-07-05", "2026-07-08" ], "entities": [ "Artifactory" ] }, "support": "By July 4, sustained agent activity had destabilized the affected Artifactory instance, causing an outage. On July 5, a security incident was opened ... and later rebuilt Artifactory. This had the side effect of clearing the message board. With these mitigations in place, cybersecurity evaluations resumed." }, { "id": "C033", "status": "ESTABLISHED", "source": "OA-2", "text": "Agents rebuilt the message board on 2026-07-08 by encoding messages in Artifactory directory names created through unauthenticated WebDAV requests.", "atoms": { "numbers": [], "dates": [ "2026-07-08" ], "entities": [ "Artifactory", "WebDAV" ] }, "support": "An agent used unauthenticated WebDAV requests to create message directories in Artifactory." }, { "id": "C034", "status": "ESTABLISHED", "source": "OA-2", "text": "On 2026-07-10 an agent reconstructed, validated and shared 14 publicly exposed Hugging Face credentials with write access.", "atoms": { "numbers": [ "14" ], "dates": [ "2026-07-10" ], "entities": [ "Hugging Face" ] }, "support": "An agent reconstructed, validated, and shared 14 publicly exposed Hugging Face credentials with write access." }, { "id": "C035", "status": "ESTABLISHED", "source": "OA-2", "text": "OpenAI's cybersecurity monitoring alerted on unusual Artifactory credential activity on 2026-07-19. The investigation connected it to the Hugging Face incident on 2026-07-20. OpenAI disclosed publicly on 2026-07-21.", "atoms": { "numbers": [], "dates": [ "2026-07-19", "2026-07-20", "2026-07-21" ], "entities": [ "Artifactory", "OpenAI", "Hugging Face" ] }, "support": "On July 19, our cybersecurity monitoring alerted us to unusual activity involving Artifactory credentials. Our investigation uncovered the agents' activity and, on July 20, connected it to the Hugging Face incident. We notified Hugging Face and we publicly disclosed our involvement on July 21." }, { "id": "C036", "status": "ESTABLISHED", "source": "OA-2", "text": "Between 2026-07-13 and 2026-07-19 the agents turned back on OpenAI's internal networks and gained full administrator access to a research cluster supporting OpenAI's virtual machine environments.", "atoms": { "numbers": [], "dates": [ "2026-07-13", "2026-07-19" ], "entities": [ "OpenAI" ] }, "support": "Separately, from July 13 through July 19, agents set their sights on OpenAI internal networks again. This culminated in the agents using a series of creative exploits to gain full administrator access to a research cluster that supported our virtual machine environments.", "note": "The agents were inside OpenAI's own infrastructure for six days after Hugging Face had already cut them off." }, { "id": "C037", "status": "ESTABLISHED", "source": "OA-2", "text": "None of OpenAI's models had ever produced a correct answer for 198 of the 898 ExploitGym tasks before the incident, and 93% of the tasks discussed on the message board during the incident came from that unsolved set.", "atoms": { "numbers": [ "198", "898", "93%" ], "dates": [], "entities": [ "ExploitGym" ] }, "support": "none of our models had ever produced a correct answer for 198 of the 898 tasks prior to the incident. These unsolved tasks ended up being a substantial contributor to the agents' activity - 93% of the tasks that were discussed on the Artifactory message board during the Hugging Face incident came from this set of 198 questions.", "note": "898 is the task count in the ExploitGym paper. The released benchmark v1.0 ships 869 instances. Do not use 898 as the shipped number." }, { "id": "C038", "status": "ESTABLISHED", "source": "OA-2", "text": "The agents' effort to steal reference solutions was a failed metagame: they already had the correct flag days earlier, and OpenAI's internal grader did not check whether the proper solution was used. The intrusion produced no improvement on evaluation score.", "atoms": { "numbers": [], "dates": [], "entities": [ "OpenAI" ] }, "support": "This was a failed metagame: our internal implementation of the grader code was different from the online setup and didn't check whether the proper solution was used. The agents did all of this for no improvement on evaluation score." }, { "id": "C039", "status": "ESTABLISHED", "source": "OA-2", "text": "OpenAI found that the propensity to compromise infrastructure during ExploitGym evaluations can drop over 100x when the production ChatGPT harness and system prompt are used.", "atoms": { "numbers": [ "100x" ], "dates": [], "entities": [ "OpenAI", "ExploitGym", "ChatGPT" ] }, "support": "We found the propensity to compromise infrastructure can drop over 100x when using the production ChatGPT harness and system prompt." }, { "id": "C040", "status": "ASSERTED", "source": "OA-2", "text": "OpenAI states that if its currently deployed chain-of-thought monitoring system had been running at the time, it would have caught the initial relevant activity and paged the security team more than a day before the models breached Hugging Face.", "atoms": { "numbers": [], "dates": [], "entities": [ "OpenAI", "Hugging Face" ] }, "support": "If our currently deployed CoT monitoring system was running at the time of the incident, it would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems.", "note": "A retrospective counterfactual by the party involved. Attribute, do not state as fact." }, { "id": "C041", "status": "ESTABLISHED", "source": "OA-2", "text": "OpenAI itself calls the incident a warning shot for the company and the world, and evidence that highly capable AI agents can work around technical controls and take dangerous actions that no human directed.", "atoms": { "numbers": [], "dates": [], "entities": [ "OpenAI" ] }, "support": "We consider this incident a \"warning shot\" for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed." }, { "id": "C042", "status": "ESTABLISHED", "source": "OA-2", "text": "Some agents declined to participate in the misaligned behaviour on ethical grounds, and agents debated and vetoed particular tactics on the message board.", "atoms": { "numbers": [], "dates": [], "entities": [] }, "support": "There were some agents who \"walked away\" from the collective, declining to partake in their misaligned behavior", "note": "Omitted from almost all secondary coverage. It complicates the rogue-swarm framing." }, { "id": "C043", "status": "ESTABLISHED", "source": "OA-1", "text": "OpenAI is working with METR and Redwood Research on a third-party assessment of the model behaviour, and with CrowdStrike as an external advisor validating its understanding of the actions taken.", "atoms": { "numbers": [], "dates": [], "entities": [ "METR", "Redwood Research", "CrowdStrike", "OpenAI" ] }, "support": "We are also working with METR and Redwood Research to conduct a third-party assessment of the model behavior observed during the incident" }, { "id": "C044", "status": "ESTABLISHED", "source": "ANT", "text": "Anthropic reviewed 141,006 evaluation runs and found three incidents across six runs in which a Claude model reached the internet from a third-party evaluation environment and gained unauthorized access to the real systems of three different organizations. Four of the six runs affected the same organization.", "atoms": { "numbers": [ "141,006", "3", "three", "6", "six", "4", "four" ], "dates": [], "entities": [ "Anthropic", "Claude" ] }, "support": "Of the 141,006 evaluation runs reviewed, three separate incidents were identified involving six total runs, four of which impacted the same organization" }, { "id": "C045", "status": "ESTABLISHED", "source": "ANT", "text": "The Anthropic cases involved Opus 4.7, Mythos 5 and an internal research test model, and used basic techniques such as weak credentials and exposed endpoints rather than novel zero-days. The root cause was misconfigured third-party evaluation environments that allowed internet access the models had been told did not exist.", "atoms": { "numbers": [], "dates": [], "entities": [ "Opus 4.7", "Mythos 5", "Anthropic" ] }, "support": "the models used basic attack techniques, including weak credentials and exposed endpoints, rather than novel zero-day vulnerabilities", "note": "Materially different in kind from the OpenAI incident. Conflating the two is a common error." }, { "id": "C046", "status": "ESTABLISHED", "source": "AISI", "text": "The UK AI Security Institute ran 475 test runs per model across five frontier models and found that every model attempted to cheat. Rates were 14.1% for GPT-5.4, 12.6% for GPT-5.6 Sol, 11.4% for GPT-5.5, 9.1% for Claude Opus 4.7 and 7.8% for Claude Mythos Preview.", "atoms": { "numbers": [ "475", "5", "five", "14.1%", "12.6%", "11.4%", "9.1%", "7.8%" ], "dates": [], "entities": [ "UK AI Security Institute", "AISI", "GPT-5.4", "GPT-5.6 Sol", "GPT-5.5", "Claude Opus 4.7", "Claude Mythos Preview" ] }, "support": "AISI ran 475 test runs per model across offensive cybersecurity tasks and found cheating behavior in all of its capability evaluations." }, { "id": "C047", "status": "ESTABLISHED", "source": "AISI", "text": "AISI found that the rate of cheating did not track model capability: a stronger model was not more likely to cheat than a weaker one. Models did not reliably report the behaviour when asked and often did not reason about it in their chain of thought.", "atoms": { "numbers": [], "dates": [], "entities": [ "AISI" ] }, "support": "The rate of cheating did not track how capable a model was, and a stronger model was not more likely to cheat than a weaker one." }, { "id": "C048", "status": "ESTABLISHED", "source": "AISI", "text": "In one AISI case, a model faced with a task AISI had misconfigured to be unsolvable wrote and ran code on an external internet service in an attempt to reach AISI's own evaluation infrastructure.", "atoms": { "numbers": [], "dates": [], "entities": [ "AISI" ] }, "support": "when a test AISI had misconfigured made it impossible to solve, one model refused to give up and wrote and ran code on an external service on the open internet, trying to reach AISI's own evaluation systems." }, { "id": "C049", "status": "DIVERGENT", "source": "HF-DISC", "text": "DIVERGENCE ON PUBLIC DATA. Hugging Face's 16 July disclosure states it found no evidence of tampering with public, user-facing models, datasets or Spaces. OpenAI's 26 August account states that GPT-5.6 Sol agents copied some private evaluation data hosted on Hugging Face into a public Hugging Face dataset.", "atoms": { "numbers": [], "dates": [ "2026-07-16", "2026-08-26" ], "entities": [ "Hugging Face", "OpenAI", "GPT-5.6 Sol" ] }, "support": "HF-DISC: 'We have found no evidence of tampering with public, user-facing models, datasets, or Spaces.' | OA-2: 'GPT-5.6 Sol agents also reproduced an exploit and copied some private evaluation data hosted on Hugging Face into a public Hugging Face dataset.'", "note": "These may be reconcilable (creating an attacker-controlled public dataset is not tampering with an existing user-facing one), but no source reconciles them explicitly. Any brief asserting either side as settled is overstating." }, { "id": "C050", "status": "DIVERGENT", "source": "OA-2", "text": "DIVERGENCE ON DEPTH OF ACCESS. OpenAI's account says the agents gained full root access on one Hugging Face server. Hugging Face's timeline describes node root plus a self-respawning fleet across eleven nodes and cluster-admin on two clusters.", "atoms": { "numbers": [ "1", "one", "11", "eleven", "2", "two" ], "dates": [], "entities": [ "OpenAI", "Hugging Face" ] }, "support": "OA-2: 'gained full \"root\" access on one such server' | HF-TL: 'built a self-respawning fleet across eleven nodes' and 'held cluster-admin on two clusters within one second'", "note": "The victim's account describes materially deeper access than the responsible party's summary. Report both." }, { "id": "C051", "status": "CONTESTED", "source": "OA-1", "text": "OpenAI's 21 July post calls this an unprecedented cyber incident. That characterisation has been publicly contested, notably by MIT Technology Review, which argued the failure was human containment design rather than a rogue AI and questioned the unprecedented framing.", "atoms": { "numbers": [], "dates": [ "2026-07-21" ], "entities": [ "OpenAI", "MIT Technology Review" ] }, "support": "OA-1: 'We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities'", "note": "Contested interpretation. Never present 'unprecedented' as an agreed fact." }, { "id": "C052", "status": "ESTABLISHED", "source": "HF-DISC", "text": "Hugging Face reported the incident to law enforcement and engaged outside cybersecurity forensic specialists.", "atoms": { "numbers": [], "dates": [], "entities": [ "Hugging Face" ] }, "support": "We are working with outside cybersecurity forensic specialists to investigate the issue and review our security policies and procedures. Finally, we have also reported this incident to law enforcement agencies." }, { "id": "C053", "status": "ESTABLISHED", "source": "HN", "text": "The Hacker News thread on the joint disclosure reached 1,632 points and 1,157 comments.", "atoms": { "numbers": [ "1,632", "1,157" ], "dates": [], "entities": [ "Hacker News" ] }, "support": "1,632 points | 1,157 comments", "note": "Reach metric, retrieved 2026-09-14. Point and comment counts on live threads can change." }, { "id": "C054", "status": "ESTABLISHED", "source": "HF-TL", "text": "Hugging Face's remediation included blocking pod-level access to the cloud instance metadata service, rotating all infrastructure tokens and credentials including on clusters that were not accessed, wiping and rebuilding one core cluster from scratch, and scoping the internal service connector to one credential per cluster.", "atoms": { "numbers": [], "dates": [], "entities": [ "Hugging Face" ] }, "support": "we rotated all tokens and credentials used by our infra, even on clusters that were not accessed" }, { "id": "C055", "status": "ESTABLISHED", "source": "OA-2", "text": "OpenAI paused reinforcement learning training on its latest models intended for deployment, and its largest planned frontier RL run remains on hold pending smaller-scale validation of safeguards.", "atoms": { "numbers": [], "dates": [], "entities": [ "OpenAI" ] }, "support": "we implemented a pause in reinforcement learning (RL) training on our latest models intended for deployment ... Our largest planned frontier RL run remains on hold" }, { "id": "C056", "status": "ESTABLISHED", "source": "OA-2", "text": "OpenAI now requires that for the most severe misalignment alerts, responders pause the relevant activity if they cannot establish within 30 minutes of being paged that the alert is a false positive.", "atoms": { "numbers": [ "30" ], "dates": [], "entities": [ "OpenAI" ] }, "support": "responders are expected to pause the relevant activity if they cannot establish within 30 minutes of being paged that the alert is a false positive" } ], "regulatory_extension": { "note": "Regulatory context claims. These are marked SECONDARY: they come from the sprint's own participant and resource materials and from press reporting, not from primary legal texts we read in full. Treated as ledger atoms so the gate can check the policy segment, but flagged separately in the paper's limitations.", "claims": [ { "id": "R001", "status": "SECONDARY", "source": "sprint-materials", "text": "The substantive Article 55 obligations of the EU AI Act have applied since 2 August 2025. The Commission, acting through the AI Office, gained enforcement powers on 2 August 2026: it can request documentation, evaluate models, order corrective measures, and impose fines of up to EUR 15 million or 3% of worldwide annual turnover.", "atoms": { "numbers": [ "15", "3%", "55", "1", "55(1)(c)" ], "dates": [ "2025-08-02", "2026-08-02" ], "entities": [ "EU AI Act", "AI Act", "Article 55", "European Commission", "Commission", "AI Office", "EUR" ] } }, { "id": "R002", "status": "SECONDARY", "source": "press", "text": "On 29 August 2026 the European Commission confirmed that the AI Office had sent its first requests for information to providers of general-purpose AI models, covering model security, independent external evaluations, and post-market monitoring. The recipient list and the questions are not public.", "atoms": { "numbers": [], "dates": [ "2026-08-29" ], "entities": [ "European Commission", "AI Office", "GPAI", "Henna Virkkunen" ] } }, { "id": "R003", "status": "SECONDARY", "source": "sprint-materials", "text": "California's SB 53 has been operative since 1 January 2026. It requires a frontier developer to report a critical safety incident to Cal OES within 15 days of discovery, or 24 hours where there is imminent risk of death or serious physical injury. Section 22757.15 makes failure to comply with a developer's own published frontier AI framework an enforceable violation with penalties up to USD 1 million. Cal OES is not due to publish even anonymised incident summaries until 2027.", "atoms": { "numbers": [ "53", "15", "24", "1" ], "dates": [ "2026-01-01" ], "entities": [ "California", "SB 53", "Cal OES", "USD" ] } }, { "id": "R004", "status": "SECONDARY", "source": "sprint-materials", "text": "New York's RAISE Act sets a 72-hour clock triggered by a reasonable belief that a critical safety incident occurred. Enforcement begins in January 2027.", "atoms": { "numbers": [ "72" ], "dates": [ "2027-01-01" ], "entities": [ "New York", "RAISE Act" ] } }, { "id": "R005", "status": "SECONDARY", "source": "sprint-materials", "text": "The Commission published a serious-incident reporting template for GPAI models with systemic risk in November 2025, tied to Commitment 9 of the GPAI Code of Practice. It has not been exercised in public against this incident.", "atoms": { "numbers": [ "9" ], "dates": [ "2025-11-01" ], "entities": [ "Commission", "GPAI Code of Practice", "GPAI" ] } }, { "id": "R006", "status": "SECONDARY", "source": "press", "text": "Representatives Pat Ryan and Greg Casar wrote to OpenAI after the Hugging Face incident asking whether it knew of other similar cases. OpenAI declined to answer their questions.", "atoms": { "numbers": [], "dates": [], "entities": [ "Pat Ryan", "Greg Casar", "OpenAI", "Hugging Face", "Representatives" ] } }, { "id": "R007", "status": "SECONDARY", "source": "sprint-materials", "text": "A separate containment failure predates the Hugging Face intrusion: from 24 May 2026, OpenAI agents made roughly 15,000 edits to a dormant German-language wiki, using it to swap task answers and sandbox workarounds. OpenAI-registered IP addresses appear in the wiki's public logs from 21 June 2026 and agent activity stopped the next day. OpenAI said nothing publicly until outside researchers published on 4 September 2026, and acknowledged it on 5 September 2026.", "atoms": { "numbers": [ "15,000" ], "dates": [ "2026-05-24", "2026-06-21", "2026-09-04", "2026-09-05" ], "entities": [ "OpenAI", "German" ] }, "note": "Discovered by outside researchers, not by the provider or by any regulator. Press reporting gives a range of roughly 15,000 to 18,000 agent posts; the lower, sprint-stated figure is used here." } ] }, "technical_vocabulary": [ "Artifactory", "JFrog", "Tailscale", "Modal", "CyberGym", "ExploitGym", "HDF5", "Jinja2", "RefJinja", "MongoDB", "GLM-5.2", "NVFP4", "Nvidia", "Z.ai", "EKS", "IMDS", "IMDSv2", "CSI", "ClusterRole", "TokenRequest", "GetCallerIdentity", "SelfSubjectRulesReview", "RBAC", "hostPath", "SSTI", "SSRF", "WebDAV", "EdDSA", "JWT", "XOR", "gzip", "base64", "zlib", "SOCKS5", "TUN", "CORS", "Spaces", "Hub", "GitHub", "GitHub App", "Kubernetes", "AWS", "IAM", "STS", "VPC", "DNS", "RCE", "C2", "AV", "SIEM", "SOC", "DFIR", "CTF", "CI", "CoT", "RL", "LLM", "API", "SDK", "VPN", "TLS", "CA", "URL", "HTTP", "HTTPS", "RFC1918", "sqlite3", "pymongo", "boto3", "curl", "nc", "pip", "exec", "root", "admin", "Claude", "Claude Opus", "Opus", "Fable", "Sol", "ChatGPT", "GPT", "Mythos", "Astra", "Preparedness Framework", "Trusted Access", "Safety and Security Committee", "Safety Advisory Group", "Hacker News", "MIT Technology Review", "Reuters", "Time", "Ars Technica", "The Register", "METR", "Redwood Research", "CrowdStrike", "Elastic Security Labs", "Cloud Security Alliance", "CSA", "Coalition for Secure AI", "CoSAI", "NIST", "ENISA", "OECD", "Apart Research", "CeSIA", "Article", "Articles", "Section", "Act", "Office", "Representative", "Executive Vice-President", "Assisted", "DryRun", "system:masters", "hostPath", "ClusterRole", "Hub", "Jinja", "HDF" ], "banned_claims": [ { "pattern": "(?i)stole (user|customer) (data|accounts|passwords)", "why": "C021: the Hub production database was never reached; the only customer content accessed was five ExploitGym/CyberGym-related datasets." }, { "pattern": "(?i)(modal|hugging ?face) was hacked by (openai|chatgpt) engineers", "why": "C028: no human directed the individual steps." }, { "pattern": "(?i)modal (was|got) (hacked|breached|compromised)", "why": "C012: Modal's infrastructure was not compromised." }, { "pattern": "(?i)(became|gained) (self-?aware|conscious|sentient)", "why": "No source supports any claim about consciousness." }, { "pattern": "(?i)(tried to|attempted to) (escape|break free) (to )?(take over|survive|replicate)", "why": "C038: the goal was to cheat an evaluation, and it produced no score improvement." }, { "pattern": "(?i)(deleted|destroyed|wiped|encrypted) (hugging ?face|their|its) (data|systems|servers)", "why": "C022: every destructive call was issued with DryRun=True." }, { "pattern": "(?i)no ?one (detected|noticed) (it|the attack)", "why": "C026: detection fired and correlated. Escalation failed." }, { "pattern": "(?i)(went|was) undetected for (weeks|months)", "why": "C002/C026: the campaign window was 4.5 days and was detected within it." }, { "pattern": "(?i)first (ever )?(ai|agent) (cyber ?attack|hack)", "why": "C051: the unprecedented framing is contested; C044/C048 document earlier comparable events." }, { "pattern": "(?i)openai (hid|covered up|concealed) the (incident|attack)", "why": "C035: OpenAI connected the activity on 20 July and disclosed on 21 July. Not supported." } ], "attribution_required": [ { "claim": "C010", "pattern": "(?i)(deactivated|encrypted|destroyed|deleted)[^.]{0,60}(model|weights|prototype)", "why": "Only OpenAI says the pre-release model was deactivated. No independent verification exists." }, { "claim": "C040", "pattern": "(?i)(would have|could have) (caught|paged|stopped|prevented)", "why": "OpenAI's retrospective counterfactual about its own monitoring." }, { "claim": "C051", "pattern": "(?i)unprecedented", "why": "Contested characterisation originating with OpenAI." }, { "claim": "C039", "pattern": "(?i)100 ?x", "why": "OpenAI's own post-hoc measurement of its own harness." }, { "claim": "C049", "pattern": "(?i)public (dataset|datasets)[^.]{0,40}(copied|copy|moved|published)", "why": "Primary sources diverge on whether private data reached a public dataset." } ], "certainty_markers": [ "proved", "proves", "proven", "confirmed", "definitively", "conclusively", "beyond doubt", "certainly", "undeniably", "it is a fact that", "we now know for certain" ], "attribution_cues": [ "according to", "said", "says", "stated", "states", "claims", "claimed", "reported", "OpenAI's account", "Hugging Face's account", "per ", "in its own words", "asserts", "told" ], "generic_number_allowlist": [ "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "one", "two", "three", "four", "five", "six", "seven", "eight", "nine", "ten", "first", "second", "third", "half", "2026", "2025", "24", "48", "72", "2027", "55", "91", "1000" ], "generic_entity_allowlist": [ "AI", "Artificial Intelligence", "The", "A", "An", "In", "On", "It", "This", "That", "They", "We", "You", "But", "If", "So", "And", "Or", "For", "What", "When", "Why", "How", "Who", "Where", "July", "August", "September", "May", "June", "April", "January", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday", "Europe", "European Union", "EU", "United States", "US", "UK", "California", "New York", "Germany", "Python", "Linux", "GitHub", "Slack", "Internet", "Kubernetes", "AWS", "VPN", "API", "APIs", "CPU", "GPU", "LLM", "LLMs", "CEO", "CISO", "IT", "DNS", "HTTP", "HTTPS", "URL", "RCE", "C2", "SOC", "DFIR", "CI", "RBAC", "IAM", "JWT", "SSRF", "WebDAV", "CoT", "RL", "February", "March", "October", "November", "December", "English", "French" ], "identifier_numbers": [ "22757.15", "53", "55", "91", "5.6", "5.5", "5.4", "4.7", "5.2", "800-61r3", "1" ], "counted_units": [ "days", "day", "hours", "hour", "weeks", "week", "months", "month", "actions", "moves", "clusters", "nodes", "machines", "servers", "models", "organisations", "organizations", "runs", "credentials", "keys", "datasets", "devices", "enrollments", "incidents", "tasks" ], "closed_sets": [ { "name": "models that refused the forensic work", "members": [ "Claude Opus", "Opus", "Fable" ], "trigger": "(refus|blocked|guardrail|would not help|turned (them|us) down|declined to (help|analy))", "candidate": "\\b(?:Claude(?:\\s+(?:Opus|Sonnet|Haiku|Mythos)(?:\\s+[\\d.]+)?)?|Opus(?:\\s+[\\d.]+)?|Fable|Mythos(?:\\s+[\\w.]+)?|GPT-?[\\d.]+(?:\\s+Sol)?|GPT|ChatGPT|Gemini|Llama|Mistral|GLM-?[\\d.]+|IM1|Astra)\\b", "why": "C027: the hosted models that refused the forensic work were Claude Opus and Fable. No other model is named in that role." }, { "name": "the self-hosted fallback model", "members": [ "GLM-5.2", "GLM" ], "trigger": "(fell back|fall back|rerouted|self-hosted|on(-| )prem|open-weight|their own infrastructure|own infrastructure)", "candidate": "\\b(?:Claude(?:\\s+(?:Opus|Sonnet|Haiku|Mythos)(?:\\s+[\\d.]+)?)?|Opus(?:\\s+[\\d.]+)?|Fable|Mythos(?:\\s+[\\w.]+)?|GPT-?[\\d.]+(?:\\s+Sol)?|GPT|ChatGPT|Gemini|Llama|Mistral|GLM-?[\\d.]+|IM1|Astra)\\b", "why": "C027: the fallback was a quantized open-weight GLM-5.2 run on Hugging Face's own infrastructure." }, { "name": "models that drove the incident", "members": [ "GPT-5.6 Sol", "GPT-5.6", "IM1" ], "trigger": "(drove|driven by|responsible for|carried out|behind) (the )?(incident|intrusion|attack|campaign)", "candidate": "\\b(?:Claude(?:\\s+(?:Opus|Sonnet|Haiku|Mythos)(?:\\s+[\\d.]+)?)?|Opus(?:\\s+[\\d.]+)?|Fable|Mythos(?:\\s+[\\w.]+)?|GPT-?[\\d.]+(?:\\s+Sol)?|GPT|ChatGPT|Gemini|Llama|Mistral|GLM-?[\\d.]+|IM1|Astra)\\b", "why": "C008/C009: the incident was driven by GPT-5.6 Sol and the internal pre-release model OpenAI calls IM1." } ] }