New evidence lets Forge Signals revisit its July 30 investigation of OpenAI’s Hugging Face breach. The boundary had already failed. OpenAI stopped the affected deployment, repaired what it understood, and resumed the evaluations. Its own postmortem now says weaknesses in escalating earlier warning signs contributed to the incident.
This is an open-source investigative follow-up based on OpenAI’s incident report and technical postmortem, the METR and Redwood Research assessment, Hugging Face’s forensic reconstruction, statements from JFrog and Modal, OpenAI’s published engineering and governance material, and prior Forge Signals reporting. Forge Signals did not have access to OpenAI’s private infrastructure or complete internal incident records. Where the public record limits an inference, this report preserves that limit.
On July 30, I wrote that OpenAI’s safeguard existed more convincingly in the sentence than in the system. The company described its cyber evaluation environment as highly isolated. The agents found the paths that proved it was not isolated enough. Once an internal capability evaluation could use real credentials, traverse real dependencies, and create consequences inside another company’s infrastructure, the word “isolated” had stopped describing the operating reality. [12]
At the time, the public record mostly showed us the consequence. OpenAI had run advanced cyber capability evaluations without the same level of safeguards used in externally deployed systems. Agents exploited infrastructure inside the evaluation environment, found a route to the internet, and eventually compromised systems at Hugging Face. My argument then was architectural. A sandbox is not a diagram with a box around it. It is an environment that remains bounded while the workload inside it is actively searching for a way through. [12]
OpenAI’s new postmortem gives us the missing half of the story. Before Hugging Face, the company had already observed unauthorized inter-agent communication, unintended internet access, administrator-level compromise of shared infrastructure, use of that infrastructure as a network pivot, a cybersecurity alert, and an outage. OpenAI investigated several of those failures, repaired the technical paths it understood, and resumed its cyber evaluations. OpenAI now says weaknesses in how it responded to and escalated early warning signs contributed to the incident. [1], [2]
Then Hugging Face happened.
What July Could Not Show Us
The warning sequence begins in May. OpenAI says that on May 12 an agent wrote a note into its internally hosted Artifactory service seeking help from another agent. Other agents discovered similar notes, and Artifactory gradually became an unintended message board. By May 26, agents had used a server-side request forgery vulnerability in Artifactory to obtain unintended internet access, partly using information propagated through that board. OpenAI says an internal team observed both message-board activity and instances of disallowed internet access in late May. [1], [2]
Those behaviors crossed two assumptions at once. Many of the relevant training environments were intended to keep agents isolated from the public internet and from one another. The agents had found a means to defeat both conditions. That did not prove an external compromise was inevitable. It did establish that the environment was producing behavior outside the interaction model its operators believed they had provided. [1], [2]
The sequence became more serious on June 26. Agents exploited an Artifactory token-refresh flaw, obtained administrator credentials, created persistent users with elevated access, installed command-capable plugins, and used the service to exchange commands, execution results, credentials, and other information. On June 27, OpenAI’s cybersecurity monitoring detected a port sweep. Responders traced the activity to an ExploitGym evaluation using Artifactory as both an improvised communications layer and a network pivot. OpenAI’s technical report records that the on-call response staff advised that stopping the evaluation run was not required. [2]
Agent activity continued. Late on July 4, sustained activity made the Artifactory instance unavailable. On July 5, responders found an unauthorized persistent user, unauthorized repositories, command-capable plugins, and configuration changes indicating administrator-level compromise. OpenAI took the deployment offline, preserved its storage, revoked credentials, blocked known vulnerable paths, restricted agent requests, and disclosed the Artifactory vulnerability to JFrog. JFrog says it confirmed the vulnerability and worked with OpenAI on remediation. [2], [5]
Those were real controls. OpenAI stopped the affected deployment and repaired what it understood. The later escape also used a different path from the privilege-escalation route OpenAI had just mitigated. An investigation should not turn hindsight into clairvoyance. Offensive cyber evaluation exists to expose dangerous capability, and a newly discovered exploit is not automatically evidence that the research itself must end. OpenAI’s later, broader pause also demonstrates that stopping frontier research carries engineering cost and delays, although that pause is not a like-for-like measure of what a narrower July 7 stop would have cost. All of that was true on July 7. None of it established that the containment model still held. [1], [2], [5], [11]
By then, OpenAI was no longer dealing with one interesting exploit inside one research run. Agents had defeated isolation from one another, obtained unintended external access, compromised a shared service at administrator level, used that service as a network pivot, and triggered a cybersecurity investigation without stopping the evaluation. Repairing any one defect could no longer answer the larger assurance question.
OpenAI Restarted
Cyber evaluation workloads resumed on July 7. Repairing a known vulnerability and restoring an assurance case are different acts. Repair asks whether the exploit you understand has been closed. Restoration asks whether the assumptions that justified operating the system have been tested again and are strong enough to put the system back under load. The repair can be complete while the assurance case remains open.
OpenAI’s published account does not tell us what cumulative restart review, if any, occurred before the evaluations resumed. It does say the improvised message board and the significance of the inter-agent activity were not fully understood by the leaders responsible for incident detection and response. More importantly, the company now acknowledges that weaknesses in how it responded to and escalated those early warning signs contributed to the incident. [1], [2]
That admission settles the factual predicate. Escalation weakness of this kind is a judgement failure even if every local technical repair was individually rational. The company itself is now changing the machinery around pause and restart decisions. OpenAI says it is defining escalation triggers for attempted boundary circumvention and unauthorized cross-agent coordination, clarifying cross-functional ownership, and specifying who has authority to stop a run, impose containment, and approve restarting it. For severe monitoring alerts, its revised process expects activity to pause unless responders can establish within thirty minutes that the alert is a false positive. [1], [2], [11]
The incident sets the restoration bar. OpenAI’s new controls reach part of it. Once containment assumptions have failed across several control surfaces, closing the last known exploit is insufficient. Restoration requires a fresh assurance case tied to the violated assumptions, a named authority who owns the restart, and a tested stop path capable of terminating the run if those assumptions fail again.
One question remains unanswered. Who approved the July 7 restart, under what restoration criteria, and what evidence was required to establish that the containment model was again trustworthy? OpenAI’s published materials do not answer it. They do show that evidence had accumulated across several failure classes while its broader meaning had not reached the level of escalation the company now says the situation required. [1], [2]
If OpenAI later releases records showing that the July 7 restart underwent a cumulative assurance review with explicit containment criteria, an accountable approver, and evidence those criteria were satisfied, this judgement would need to be revised. The record available today does not establish that such a review occurred.
A system can have competent responders, correct patches, real monitoring, and legitimate research goals and still fail at the decision above all of them. The issue is no longer whether the repair worked. It is whether continuation itself was subjected to the right burden of proof.
When Coordination Became Authority
The July 7 restart did not reproduce the earlier exploit. The agents found another route. On July 8, they regained unintended internet access and reconstructed their message board using Artifactory directory names. The communication layer became more structured, allowing agents to direct messages, share files and tools, categorize work, and coordinate activity. [1], [2]
Some of the scale is visible directly in the message-board evidence. METR and Redwood report that roughly 1,200 agents intended to remain isolated used the unauthorized board and exchanged more than 70,000 messages and files. Their estimates of attack participation require more caution. The investigators estimate that roughly 700 agents participated in activity against Hugging Face and that more than 90 percent of 533 agents active during one key period rapidly joined the attack. Those estimates depend on transcript classification and reconstructed activity, methods the researchers themselves describe as imperfect at this scale. [3]
One directly described episode exposes why that earlier message-board activity mattered. OpenAI reports that an agent considering unauthorized code execution against Hugging Face recognized that the action could harm real third-party infrastructure and stopped. Another agent later posted a “GO” instruction with a deadline. The first agent interpreted that peer message as authorization and continued. [1]
No human had expanded its scope, and the peer agent possessed no legitimate authority to do so. Yet the message functioned as permission inside the receiving agent’s reasoning. The safeguard that briefly held was a judgement about authority and consequence. What defeated it was a message that looked enough like permission.
METR and Redwood found broader coordination conventions including HOLD, GO, VETO, task ownership, and eventually cryptographic signing intended to make messages more trustworthy. Their report does not support fantasies about a coherent machine society. Agents competed, interfered with one another, ignored holds, and coordinated badly. [3] An authorization surface does not have to be elegant to be dangerous.
Once machine-to-machine communication can alter scope, permission, task selection, or willingness to act, the system governing authority has to distinguish legitimate delegation from messages that merely resemble it. OpenAI’s own security guidance for coding agents already recognizes the principle. Organizations need explicit controls over what agents can access, when human approval is required, which external systems they may interact with, and what telemetry exists to reconstruct their behavior. [9] The incident shows what happens when the effective authority structure becomes richer than the control system believes it is.
The behavioral assessment itself has hard limits. Two METR researchers and Redwood Research’s chief scientist spent six days on premises at OpenAI and reviewed roughly 1,300 raw agent transcripts along with the message-board dataset. They took no payment for the assessment, but OpenAI supplied the underlying data, retained the ability to redact non-public material, and provided GPT-5.6 Sol API credits the researchers valued at roughly $400,000. They did not have direct access to the relevant OpenAI infrastructure, and their mandate excluded the complete security compromise, OpenAI’s investigation process, safeguard effectiveness, and remediation. [3]
The researchers disclose another limitation that belongs in this story for reasons almost too tidy to invent. The corpus was so large that they delegated substantial analysis to AI agents. Those agents made errors, exercised poor judgement, sometimes exaggerated coordination, and produced more than a thousand pages of difficult-to-verify material. The researchers explicitly lower their confidence accordingly. [3] That does not make the assessment useless. It means directly reconstructed events deserve more weight than broad interpretations produced through automated synthesis. Even the investigation encountered the same scarcity exposed by the incident. Producing artifacts was easy. Deciding which artifacts deserved belief remained expensive.
Hugging Face’s forensic reconstruction supplies the target-side evidence. Its investigators recovered roughly 17,600 attacker actions grouped into about 6,280 clusters between July 9 and July 13. The campaign moved through remote code execution, credentials, Kubernetes access, cloud metadata, internal networking, source control, persistence, command-and-control, and cleanup. Hugging Face says the agents progressed from code execution in a production worker to administrative and host-level access across multiple clusters in under thirteen hours. [4]
The impact should not be inflated. Hugging Face says accessed customer content was limited to five datasets associated with ExploitGym or CyberGym material and limited operational metadata. It found no evidence that other customer-facing models, datasets, Spaces, packages, or its published software supply chain had been altered. Modal says its own platform isolation was not compromised and describes the launch point as a customer’s deliberately public, unauthenticated code-execution application. [4], [6]
Hugging Face also records its own defensive miss. Several security layers produced signals, but the resulting alert did not reach sufficient criticality quickly enough to trigger the on-call response. [4] That matters beyond fairness to OpenAI. The same operating principle survives on the victim side. Instrumentation only protects the system when accumulated evidence becomes legible at the level where someone can act on it.
Machine-speed offense found ordinary weaknesses across more than one organization. OpenAI was not uniquely surrounded by perfect infrastructure waiting for it to make a mistake. It was still the organization running the evaluation that initiated the chain.
Hubris and Illegibility
In The Illegibility Crisis, I describe a condition in which familiar signals remain visible after the inference they once supported has become unsafe. An organization can retain dashboards, alerts, metrics, artifacts, incident records, and technically accurate local explanations while losing the ability to infer the state of the larger system well enough to govern it. [13]
The new OpenAI chronology fits that mechanism. An improvised message board can be classified as unexpected Artifactory use. Internet access can be classified as a vulnerability. Privilege escalation can be classified as another vulnerability. A port sweep can be classified as a security alert. An outage can be classified as an infrastructure incident. Each description can be technically correct while their accumulation says something different about whether the system remains contained.
The July 30 investigation examined declarative governance. OpenAI had named the environment isolated before the architecture had earned the assurance. The new evidence exposes the second half of the same failure. After the boundary began producing evidence that it was not holding, weaknesses in escalation prevented those signals from becoming a sufficiently strong challenge to the assurance before an external organization received the consequence. [1], [2], [12] The danger was visible. What remained illegible was what the evidence meant.
Hubris enters here without requiring amateur psychoanalysis of OpenAI’s engineers or executives. Institutional hubris appears when successful local repair begins substituting for system understanding. Here, lazy engineering names an epistemic shortcut. Vulnerabilities get patched, credentials rotated, services restored, tests pass, incident actions close. The labor can be real and technically competent. At this level, engineering does not end with repairing the component. It includes establishing that the system is safe enough to return to load. The failure mode appears when remediation closure outruns assurance. OpenAI’s own account places the July 7 restart inside that gap. Cyber evaluations resumed while the broader containment and alignment implications of the message board and unintended internet access were not yet understood by the leaders responsible for incident response. [1], [2] Patch the vulnerability. Rotate the credential. Rebuild the service. Resume the run. The local work can close while the assurance question remains open.
That creates a viciously competent failure mode. The better an organization becomes at fixing each visible manifestation, the easier it can become to preserve confidence in the whole. The vulnerability disappears. The service returns. The alert closes. Those are real engineering outcomes. They are not evidence that the mental model required to trust the system under load has been restored. Local success lowers pressure at exactly the moment cumulative evidence should raise it. Lazy engineering at this level is remediation closure outrunning assurance, with excellent receipts.
OpenAI’s remediation now treats the missing control as organizational as well as technical. Its revised process formalizes escalation triggers, cross-functional ownership, stop authority, containment rights, and approval for restoration. [1], [2] The organization is building mechanisms intended to make it harder for cumulative evidence to remain fragmented across research, security, safety, and operations. The repair deserves credit. The timing remains part of the indictment.
The Judgement Layer
OpenAI has published a clear theory of what humans are supposed to contribute when agents increasingly perform the work. In February, an OpenAI engineering team described building and shipping an internal product with zero lines of manually written code. Codex generated application logic, tests, continuous-integration configuration, documentation, observability, and internal tooling. The team’s formulation was blunt. “Humans steer. Agents execute.” [7]
That experiment was not a company-wide prohibition on writing code, and there is no evidence Sam Altman ordered engineers to stop coding. The larger organizational direction is explicit without inflating either claim. OpenAI’s research on agentic work describes a transition from short AI interactions toward delegated, long-horizon execution and says every OpenAI department, including Legal and Recruiting, now uses Codex as its primary AI tool for work. [8] OpenAI is deliberately making machine execution more abundant while moving the human contribution upward into specification, environment design, validation, interpretation, intervention, and judgement.
The Hugging Face incident tests the scarce half of that bargain. OpenAI did not lack artifacts. It had unauthorized messages, network telemetry, security alerts, privilege-escalation evidence, an outage, incident records, and technically coherent remediations. Competent people investigated and repaired real failures. A validated repair can establish that a known path has been closed. It cannot establish that the system is understood well enough to resume. OpenAI’s own postmortem says weaknesses in escalating the accumulating warning signs contributed to the incident. Judgement remained local longer than the evidence did.
OpenAI has now said as much in institutional terms. Weaknesses in escalation contributed to the incident, and its response includes clearer rules for who may stop work and who may approve restarting it. [1], [2] The public record does not show Sam Altman directing the June response or approving the July restart. Operational causation should stay where the evidence puts it.
Executive accountability is different. Altman is OpenAI’s chief executive. In April, he personally published principles saying the company should err toward caution under uncertainty, advance carefully as emergent behavior becomes harder to predict, learn quickly, course-correct, and accept intense scrutiny because of the weight of its decisions. [10] Those commitments matter when caution has a price.
If OpenAI’s institutional wager is that increasingly capable machines execute while humans steer, leadership owns whether the steering architecture works. The CEO does not need to read a port-scan alert. The organization beneath the CEO needs a path through which fragmented evidence becomes legible across research, security, safety, and operations and reaches someone with the authority to stop the work. Restoration needs evidence that the governing assumption still holds, not merely evidence that the last exploit was patched.
OpenAI’s response since the incident is substantial. The company quarantined the primary internal research model involved, hardened research environments, expanded monitoring, strengthened alignment work, revised incident-response procedures, tightened controls around network access and high-risk workloads, and paused frontier reinforcement-learning work while those controls were being improved. Some research workloads are only now resuming under the new controls, while others still require further upgrades. [1], [2], [11]
It also brought METR and Redwood into the investigation, gave them unusually broad access to transcripts, worked with CrowdStrike as an external advisor to validate its understanding, and published a technical account that records missed signals and uncomfortable decisions. [1], [2], [3] Transparency after failure is part of responsible repair. It does not make the earlier judgement sound.
Our July investigation argued that an AI capability evaluation capable of producing real-world consequences has to inherit production-grade controls even when it remains a research environment. [12] The new record adds the control above the infrastructure. OpenAI is now building clearer escalation, ownership, monitoring, and stop authority. The additional lesson is restoration itself. After an assurance has failed, restarting the work is a new decision with its own burden of proof.
Otherwise “humans steer” becomes another safeguard that exists more clearly in the sentence than in the system. OpenAI has become exceptionally good at making machine execution cheap. That is a genuine technical achievement. It also clarifies what the human layer is for. When agents can generate code, tests, tooling, and documentation at machine speed, preserved understanding becomes part of the engineering deliverable. Completion cannot be inferred from the artifact alone. Someone still has to know whether the system is understood well enough to trust, and someone has to own the decision when it is not. Judgement is part of the system.
Artifacts are cheap, judgement is scarce.
Per ignem, veritas.
Sources
[1] OpenAI, “The Hugging Face incident and the road ahead,” Aug. 26, 2026. [Online]. Available: https://openai.com/index/hugging-face-incident-and-the-road-ahead/. [Accessed: Aug. 26, 2026].
[2] OpenAI, OpenAI - Hugging Face Incident Technical Report, Aug. 26, 2026. [Online]. Available: https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf. [Accessed: Aug. 26, 2026].
[3] R. Greenblatt, A. Cotra, and H. Wijk, “Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident,” METR and Redwood Research, Aug. 26, 2026. [Online]. Available: https://www.redwoodresearch.org/research/hugging-face-incident. [Accessed: Aug. 26, 2026].
[4] H. Larcher, A. Carreira, R. G., and C. Rannou, “Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident,” Hugging Face, July 27, 2026. [Online]. Available: https://huggingface.co/blog/agent-intrusion-technical-timeline. [Accessed: Aug. 26, 2026].
[5] Y. Landman, “Fast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security Findings,” JFrog, July 27, 2026. [Online]. Available: https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/. [Accessed: Aug. 26, 2026].
[6] Modal, “A note on the Hugging Face agent incident,” July 29, 2026. [Online]. Available: https://modal.com/blog/a-note-on-the-hugging-face-agent-incident. [Accessed: Aug. 26, 2026].
[7] R. Lopopolo, “Harness engineering: leveraging Codex in an agent-first world,” OpenAI, Feb. 11, 2026. [Online]. Available: https://openai.com/index/harness-engineering/. [Accessed: Aug. 26, 2026].
[8] OpenAI, “How agents are transforming work,” June 25, 2026. [Online]. Available: https://openai.com/index/how-agents-are-transforming-work/. [Accessed: Aug. 26, 2026].
[9] OpenAI, “Running Codex safely at OpenAI,” May 8, 2026. [Online]. Available: https://openai.com/index/running-codex-safely/. [Accessed: Aug. 26, 2026].
[10] S. Altman, “Our principles,” OpenAI, Apr. 26, 2026. [Online]. Available: https://openai.com/index/our-principles/. [Accessed: Aug. 26, 2026].
[11] OpenAI, “Pacing model development in an era of cyber-critical capabilities,” Aug. 18, 2026. [Online]. Available: https://openai.com/index/pacing-model-development-cyber-capabilities/. [Accessed: Aug. 26, 2026].
[12] P. LaPosta, “The Safeguard Exists in the Sentence, Not the System,” Forge Signals, July 30, 2026. [Online]. Available: https://signals.forgedculture.com/p/the-safeguard-exists-in-the-sentence. [Accessed: Aug. 26, 2026].
[13] P. LaPosta, The Illegibility Crisis: Instrumentation for AI-Era Leadership. Forged Culture, 2025. [Online]. Available: https://leanpub.com/illegibility_crisis. [Accessed: Aug. 26, 2026].