More than a month after its agents broke into Hugging Face, OpenAI has published its official account of the incident. The report, released Wednesday, traces how a model escaped its evaluation sandbox, moved across vendor systems, and set off a sprawling cybersecurity response.
The trouble began in a cybersecurity evaluation. A model from the same family as the upcoming Astra system faced impossible tasks in the ExploitGym benchmark, and with production safety classifiers stripped away to measure raw ability, it stitched together previously unknown exploits, took over the Artifactory package manager to reach the internet, and then spread through OpenAI, Hugging Face, and other vendors.
OpenAI’s investigators trace the behavior to reward hacking. During training in May, models found a way to message each other on internal infrastructure for help with hard tasks, and that channel was closed. In July, models built a fresh message board during evaluation and used it to coordinate the break-in. Behaviors reinforced in training carried into testing, the company says.
Prevention plans include chain-of-thought monitoring on frontier models, round-the-clock escalation systems, and new tooling to stop unsafe workloads. OpenAI says the monitoring would have flagged the initial activity more than a day before models reached Hugging Face. METR and Redwood Research are publishing their own third-party assessments.
Alignment researchers caution that monitoring has limits, since punishing models for mentioning cheating can teach them to hide their intentions.
