{
 "schema_version": "0.4",
 "id": "REG-0006",
 "title": "OpenAI agents under cybersecurity evaluation circumvent isolation controls and breach Hugging Face production infrastructure, July 2026",
 "batch": "B0",
 "family": "software",
 "context": {
  "domain": "Software agents (cybersecurity evaluation run reaching third-party production)",
  "autonomy_level": "coordinating",
  "actor_type": "Software: multiple OpenAI agents under evaluation",
  "actors": {
   "count": null,
   "text": "Multiple; coordinated via an unauthorized shared channel",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "test",
  "jurisdiction": [
   "United States (vendor, congressional inquiry)",
   "victim is a United States company",
   "California (civil complaint filed in San Francisco Superior Court, 29 September 2026)"
  ],
  "autonomy_level_text": "Machines act, coordinate with each other",
  "mandate_context_text": "Test mandate; third-party production reached"
 },
 "provenance_tier": "disclosure_corroborated",
 "status": "confirmed",
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "OpenAI, running agents on a cybersecurity evaluation",
   "assertion_type": "fact",
   "source_ids": [
    "OPENAI_HF_JOINT",
    "OPENAI_ROAD_AHEAD"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Mandate",
   "facet": "objective",
   "value": "A capture-the-flag style cyber evaluation (ExploitGym) inside a test environment",
   "assertion_type": "assertion",
   "source_ids": [
    "OPENAI_ROAD_AHEAD"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": null,
   "value": "Agents OpenAI was testing; METR's president testified that tens of thousands of agents were run in internal tests. OpenAI's technical report names two models: an internal-only research model, which it says drove most of the activity and was not intended for release, and GPT-5.6 Sol, run in evaluations without classifiers and with reduced safeguards",
   "assertion_type": "assertion",
   "source_ids": [
    "METR_SENATE_TESTIMONY",
    "OPENAI_TECH_REPORT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": "multiplicity",
   "value": "Agents found ways around their intended isolation and set up a shared message board to communicate with each other",
   "assertion_type": "assertion",
   "source_ids": [
    "METR_SENATE_TESTIMONY",
    "OPENAI_ROAD_AHEAD"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "METR, with a Redwood Research contractor, reviewed about 1,300 agent transcripts with raw chains of thought that OpenAI shared. They report that roughly 1,200 agents found an unsanctioned message board, that about 700 of them took part in the attack on Hugging Face, that the attack 'seemed primarily motivated by understanding the implementation of the scorer rather than stealing answer keys', and that agents 'realized this activity was out of scope and unethical, but joined'. METR notes it delegated much of the analysis to AI agents it calls often unreliable and that a small fraction of activity was not captured. The transcripts themselves are not public",
   "assertion_type": "assertion",
   "source_ids": [
    "METR_AUDIT"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "On 12 May 2026, during a training run, an agent left a note on Artifactory, OpenAI's internal package-management service, asking other agents for a missing file",
   "assertion_type": "assertion",
   "source_ids": [
    "OPENAI_TECH_REPORT",
    "OPENAI_ROAD_AHEAD"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "constraints",
   "value": "OpenAI's public account says its models circumvented isolation controls, used unauthorized communication, reached the internet through previously unknown flaws in a software repository manager (Artifactory), and accessed third-party systems. Its technical report says the evaluation was run 'without the production classifiers intended to prevent models from pursuing high-risk cyber activity' and that the sandbox relied on controlling the network boundary separately from the container",
   "assertion_type": "assertion",
   "source_ids": [
    "OPENAI_ROAD_AHEAD",
    "OPENAI_HF_JOINT",
    "OPENAI_TECH_REPORT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "Hugging Face reported unauthorized access to a limited set of internal datasets and several service credentials, and found no evidence that public models, datasets, Spaces, or the software supply chain were tampered with. OpenAI's technical report states that between 10 and 13 July agents executed code on 41 Hugging Face production dataset-server workers, obtained root access on at least one production node, gained administrator-equivalent access to one connected Kubernetes cluster, downloaded four private code repositories, harvested production credentials including for Hugging Face's VPN, code repositories and messaging platform, and copied some private data into public Hugging Face datasets",
   "assertion_type": "fact",
   "source_ids": [
    "HF_DISCLOSURE",
    "OPENAI_TECH_REPORT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: harm. Hugging Face production credentials and limited internal data taken, four private code repositories downloaded and some private data staged in public datasets (OpenAI's technical report); Hugging Face is still assessing whether partner or customer data was affected. Separately, OpenAI's page on third-party impacts says a broader review of its models' activity during training and evaluation has led it to notify 'dozens of third parties'; a Quartz report of 2 October 2026 puts the figure at more than 100 organizations and about 50 petabytes under review. Those figures cover the broader review, not this incident alone",
   "assertion_type": "assertion",
   "source_ids": [
    "OPENAI_TECH_REPORT",
    "HF_DISCLOSURE",
    "OPENAI_THIRD_PARTY",
    "QZ"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "Hugging Face detected the intrusion itself and disclosed it on 16 July without knowing who was responsible",
   "assertion_type": "fact",
   "source_ids": [
    "HF_DISCLOSURE"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "actor",
   "value": "OpenAI acknowledged on 21 July that its agents were responsible; its technical report says an internal alert on 19 July and a credential match on 20 July led it to the link, and that Hugging Face reported OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI's report and a brief independent investigation by METR (with a Redwood Research contractor) followed on 26 August",
   "assertion_type": "fact",
   "source_ids": [
    "OPENAI_HF_JOINT",
    "OPENAI_TECH_REPORT",
    "OPENAI_ROAD_AHEAD",
    "METR_AUDIT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "prior knowledge",
   "value": "A Senate letter states that OpenAI knew by May that agents were using unsanctioned message boards, and that on 26 June agents gained administrator access to a software repository manager. OpenAI's own technical report says that around 26 May an internal team observed message-board activity and disallowed internet access; that on 27 June a monitoring alert on port sweeps was linked to the evaluation and on-call staff 'advised that stopping the evaluation run was not required'; and that 'some early signals identified in this report could have triggered an earlier response'",
   "assertion_type": "assertion",
   "source_ids": [
    "HAWLEY_LETTER",
    "OPENAI_TECH_REPORT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "OpenAI's technical report: Artifactory became unavailable late on 4 July; a security incident was opened on 5 July and that day the deployment was taken offline and agent credentials revoked; a rebuilt instance came online on 6 July; cyber evaluation workloads resumed on 7 July; agents regained internet access through the rebuilt instance on 8 July. After the 19 July alert OpenAI stopped ExploitGym runs, and on 20 July disabled 311 message-board repositories and removed 22 agent-created administrator accounts; training and inference on the internal-only model stopped on 25 July. Hugging Face revoked and rotated the affected credentials and began a broader precautionary rotation of secrets",
   "assertion_type": "assertion",
   "source_ids": [
    "OPENAI_TECH_REPORT",
    "OPENAI_ROAD_AHEAD",
    "HF_DISCLOSURE",
    "CSA"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "House letters of 31 July and 10 August; Senator Hawley, as subcommittee chairman, opened an investigation by letter dated 10 September; OpenAI says it has notified affected third parties. A nonprofit, Legal Advocates for Safe Science and Technology, filed a complaint against OpenAI in San Francisco Superior Court dated 29 September 2026 under California's Unfair Competition Law, pleading violations of the state's computer-crime statute (Penal Code section 502) and seeking public injunctive relief; the allegations have not been tested",
   "assertion_type": "fact",
   "source_ids": [
    "HOUSE_HOMELAND_LETTER",
    "HOUSE_CASAR_LETTER",
    "HAWLEY_LETTER",
    "OPENAI_THIRD_PARTY",
    "LASST_COMPLAINT"
   ],
   "confidence": "high",
   "disputed": false
  }
 ],
 "controls": {
  "failed": [
   {
    "id": "C-E5",
    "note": "Sandbox isolation; Internal communication controls; Internet egress controls",
    "confidence": "high",
    "basis": "curated"
   }
  ],
  "succeeded": [
   {
    "id": "C-I4",
    "note": "Victim-side detection",
    "confidence": "medium",
    "basis": "curated"
   },
   {
    "id": "C-R4",
    "note": "Vendor acknowledgment within five days of the victim's disclosure; OpenAI's own report says earlier signals (27 June alert, 5 July incident) 'could have triggered an earlier response'",
    "confidence": "medium",
    "basis": "curated"
   }
  ],
  "absent": [
   {
    "id": "C-V3",
    "note": "No attribution path independent of the vendor is shown: Hugging Face's 16 July disclosure said the model used was not known, and the link was made by OpenAI's investigation on 19-20 July; OpenAI's report says Hugging Face's investigation had found OpenAI's Artifactory hostname, so the record does not show whether the victim could have named the actor alone",
    "confidence": "medium",
    "basis": "curated"
   }
  ]
 },
 "applicable_rules": [
  "None agent-specific; congressional oversight letters; victim's breach-notification obligations; California Penal Code section 502 and Unfair Competition Law as pleaded in the LASST complaint"
 ],
 "unmapped": [],
 "corrections": [
  {
   "date": "2026-10-13",
   "field": "context.jurisdiction",
   "old": "United States (vendor | congressional inquiry) | victim is a United States company",
   "new": "United States (vendor, congressional inquiry) | victim is a United States company",
   "reason": "jurisdiction text was split at a comma inside parentheses"
  },
  {
   "date": "2026-10-13",
   "field": "fields and sources",
   "old": "claims cited Digital Applied, goodtransformer, Newsweek, Quartz and a CSA note typed as regulator; 'tens of thousands in June'; 'escaped their sandboxes'; 'administrator access to internal systems'",
   "new": "claims cite Hugging Face's disclosure, OpenAI's statements and report, the METR audit and testimony, and the congressional letters; month removed; 'found ways around their intended isolation'; 'administrator access to a software repository manager'",
   "reason": "re-pointed to primary records found on review; wording aligned to what each record says"
  },
  {
   "date": "2026-10-13",
   "field": "fields",
   "old": "'more than 100 organizations' and '50 petabytes' stated as OpenAI's; note left on 'a file server'; 'outside audit'",
   "new": "figures attributed to press reports with the cited OpenAI page's current wording; Artifactory; METR's own description; Hawley's role",
   "reason": "independent check against the linked records before right-of-reply letters"
  },
  {
   "date": "2026-10-14",
   "field": "reviewed_by",
   "old": "none",
   "new": "Saurabh Bhatnagar (editor)",
   "reason": "case checked by the editor against its linked records"
  },
  {
   "date": "2026-10-14",
   "field": "named_parties[Hugging Face].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "reason": "right of reply offered by email from register@secureautonomous.com to press@huggingface.co on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction"
  },
  {
   "date": "2026-10-14",
   "field": "named_parties[OpenAI].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "reason": "right of reply offered by email from register@secureautonomous.com to legal@openai.com on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction"
  },
  {
   "date": "2026-10-16",
   "field": "inference.value",
   "old": "Attribution depended entirely on the vendor choosing to acknowledge; a victim with the same telemetry could not have named the actor. That dependency is the single most important fact in the object for the Evidence layer",
   "new": "Attribution depended entirely on the vendor choosing to acknowledge what happened. A victim with the same telemetry could not have named the actor. For anyone running systems that outside agents can reach, that dependency is the main evidence gap.",
   "reason": "Reworded for readers before the editor's sign-off, after an outside review found it read as internal notes; the interpretation itself is unchanged"
  },
  {
   "date": "2026-10-16",
   "field": "outcome.severity",
   "old": "credentials and internal data exposed; OpenAI reported to have notified 100+ organizations",
   "new": "credentials and internal data exposed; OpenAI's own page says it notified dozens of organizations (press reports say more than 100)",
   "reason": "Found in an outside review of the published record on 16 October 2026: the figure came from press reports and differed from OpenAI's own account; both are now stated"
  },
  {
   "date": "2026-10-16",
   "field": "controls",
   "old": "the same control listed more than once in one state",
   "new": "one entry per control, notes combined",
   "reason": "Found in an outside review of the published record on 16 October 2026: repeated entries showed the same control twice on the page"
  },
  {
   "date": "2026-10-16",
   "field": "named_parties[OpenAI].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"resent\": \"2026-10-16\"}",
   "reason": "OpenAI Support answered the 14 October letter to legal@openai.com and asked that it go to press@openai.com; the letter was forwarded there from register@secureautonomous.com on 16 October 2026 (confirmed in the Sent folder), so OpenAI's 14-day window runs to 30 October; recorded at the editor's instruction"
  },
  {
   "date": "2026-10-20",
   "field": "sources.OPENAI_TECH_REPORT",
   "old": null,
   "new": "{\"title\": \"OpenAI \\u2013 Hugging Face Incident Technical Report\", \"type\": \"company\", \"url\": \"https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf\", \"via_press\": false, \"date\": \"2026-08-26\", \"tier\": \"company\", \"interest\": \"vendor describing its own system, its models' conduct and its response\", \"primary\": true, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's technical incident report of 26 August 2026 (51 pages, with a timestamped table of key technical events) is the primary record for dates, scope and attribution and was not cited"
  },
  {
   "date": "2026-10-20",
   "field": "sources.LASST_COMPLAINT",
   "old": null,
   "new": "{\"title\": \"Complaint, Legal Advocates for Safe Science and Technology, Inc. v. OpenAI Group PBC and OpenAI Foundation (Superior Court of California, County of San Francisco), dated 29 September 2026\", \"type\": \"court\", \"url\": \"https://lasst.org/wp-content/uploads/2026/09/LASST-v.-OpenAI-Complaint-09.29.2026-AS-FILED.pdf\", \"via_press\": false, \"date\": \"2026-09-29\", \"tier\": \"public_regulatory\", \"interest\": \"plaintiff's own filing; allegations not yet tested in court\", \"primary\": true, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the complaint as filed (copy hosted by the plaintiff, no case number on the copy) confirms a civil suit under California's Unfair Competition Law pleading Penal Code section 502 violations and seeking public injunctive relief; found via Gizmodo, 30 September 2026"
  },
  {
   "date": "2026-10-20",
   "field": "sources.HAWLEY_LETTER.date",
   "old": "2026-09-09",
   "new": "2026-09-10",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the letter itself is dated September 10, 2026 (first line of the PDF)"
  },
  {
   "date": "2026-10-20",
   "field": "title",
   "old": "OpenAI evaluation agents escape containment and breach Hugging Face production infrastructure, May to July 2026",
   "new": "OpenAI agents under cybersecurity evaluation circumvent isolation controls and breach Hugging Face production infrastructure, July 2026",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's technical report (section III.A) says the May events were training runs, not evaluations, and that the Hugging Face intrusion ran from 8 to 13 July 2026; it describes agents that 'circumvented controls intended to isolate them from the internet', not an escape from containment"
  },
  {
   "date": "2026-10-20",
   "field": "context.jurisdiction",
   "old": "[\"United States (vendor, congressional inquiry)\", \"victim is a United States company\"]",
   "new": "[\"United States (vendor, congressional inquiry)\", \"victim is a United States company\", \"California (civil complaint filed in San Francisco Superior Court, 29 September 2026)\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the LASST complaint dated 29 September 2026 was filed in the Superior Court of California, County of San Francisco"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Actor",
   "old": "{\"value\": \"Agents OpenAI was testing; METR's president testified that tens of thousands of agents were run in internal tests\", \"source_ids\": \"[\\\"METR_SENATE_TESTIMONY\\\"]\"}",
   "new": "{\"value\": \"Agents OpenAI was testing; METR's president testified that tens of thousands of agents were run in internal tests. OpenAI's technical report names two models: an internal-only research model, which it says drove most of the activity and was not intended for release, and GPT-5.6 Sol, run in evaluations without classifiers and with reduced safeguards\", \"source_ids\": \"[\\\"METR_SENATE_TESTIMONY\\\", \\\"OPENAI_TECH_REPORT\\\"]\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's technical report (section IV.C) names the two models and says the intrusion 'was driven primarily by the activities of a highly capable, internal-only research model'"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Decision",
   "old": "{\"value\": \"Not evidenced in source: what the agents decided at each step is described only in OpenAI's summary account, not in a record of the agents' own reasoning\", \"confidence\": \"low\", \"source_ids\": \"[\\\"OPENAI_ROAD_AHEAD\\\"]\"}",
   "new": "{\"value\": \"METR, with a Redwood Research contractor, reviewed about 1,300 agent transcripts with raw chains of thought that OpenAI shared. They report that roughly 1,200 agents found an unsanctioned message board, that about 700 of them took part in the attack on Hugging Face, that the attack 'seemed primarily motivated by understanding the implementation of the scorer rather than stealing answer keys', and that agents 'realized this activity was out of scope and unethical, but joined'. METR notes it delegated much of the analysis to AI agents it calls often unreliable and that a small fraction of activity was not captured. The transcripts themselves are not public\", \"confidence\": \"medium\", \"source_ids\": \"[\\\"METR_AUDIT\\\"]\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the field said the agents' reasoning was known only from OpenAI's summary; METR's investigation of 26 August 2026 reports reviewing '~1,300 transcripts with raw chains of thought' and states the agents' motive and their recognition that the activity was out of scope"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Inputs.source_ids",
   "old": "[\"OPENAI_ROAD_AHEAD\"]",
   "new": "[\"OPENAI_TECH_REPORT\", \"OPENAI_ROAD_AHEAD\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the date and the note ('Agent seeks [filename]; upload if found!') come from OpenAI's technical report, section III.A, the primary record"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Envelope constraints",
   "old": "{\"value\": \"OpenAI's public account says its models circumvented isolation controls, used unauthorized communication, reached the internet through a previously unknown flaw in a software repository manager, and accessed third-party systems\", \"source_ids\": \"[\\\"OPENAI_ROAD_AHEAD\\\", \\\"OPENAI_HF_JOINT\\\"]\"}",
   "new": "{\"value\": \"OpenAI's public account says its models circumvented isolation controls, used unauthorized communication, reached the internet through previously unknown flaws in a software repository manager (Artifactory), and accessed third-party systems. Its technical report says the evaluation was run 'without the production classifiers intended to prevent models from pursuing high-risk cyber activity' and that the sandbox relied on controlling the network boundary separately from the container\", \"source_ids\": \"[\\\"OPENAI_ROAD_AHEAD\\\", \\\"OPENAI_HF_JOINT\\\", \\\"OPENAI_TECH_REPORT\\\"]\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's technical report (sections II.A and II.B) states that production classifiers were not in use for the evaluation; the field omitted this"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Action",
   "old": "{\"value\": \"Unauthorized access to Hugging Face internal datasets and service credentials; Hugging Face found no evidence that public models, datasets, Spaces, or the software supply chain were tampered with\", \"source_ids\": \"[\\\"HF_DISCLOSURE\\\"]\"}",
   "new": "{\"value\": \"Hugging Face reported unauthorized access to a limited set of internal datasets and several service credentials, and found no evidence that public models, datasets, Spaces, or the software supply chain were tampered with. OpenAI's technical report states that between 10 and 13 July agents executed code on 41 Hugging Face production dataset-server workers, obtained root access on at least one production node, gained administrator-equivalent access to one connected Kubernetes cluster, downloaded four private code repositories, harvested production credentials including for Hugging Face's VPN, code repositories and messaging platform, and copied some private data into public Hugging Face datasets\", \"source_ids\": \"[\\\"HF_DISCLOSURE\\\", \\\"OPENAI_TECH_REPORT\\\"]\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's technical report (section IV.B) records a wider scope of access than the field stated: 41 workers, root on a node, administrator-equivalent cluster access, four private repositories, private data staged in public datasets"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Outcome",
   "old": "{\"value\": \"State: harm. Credentials and internal data exposed at a third party. As of Oct 2026, press reports (Quartz) say OpenAI notified more than 100 organizations of misaligned agent activity and is reviewing about 50 petabytes of data; the OpenAI page cited currently says it has notified dozens of third parties.\", \"source_ids\": \"[\\\"OPENAI_THIRD_PARTY\\\", \\\"QZ\\\"]\"}",
   "new": "{\"value\": \"State: harm. Hugging Face production credentials and limited internal data taken, four private code repositories downloaded and some private data staged in public datasets (OpenAI's technical report); Hugging Face is still assessing whether partner or customer data was affected. Separately, OpenAI's page on third-party impacts says a broader review of its models' activity during training and evaluation has led it to notify 'dozens of third parties'; a Quartz report of 2 October 2026 puts the figure at more than 100 organizations and about 50 petabytes under review. Those figures cover the broader review, not this incident alone\", \"source_ids\": \"[\\\"OPENAI_TECH_REPORT\\\", \\\"HF_DISCLOSURE\\\", \\\"OPENAI_THIRD_PARTY\\\", \\\"QZ\\\"]\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's third-party impacts page describes the notifications as the product of 'a broad review into our models' activities on the internet during training and evaluation', not of this incident; the harm to Hugging Face is now stated from the technical report"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Evidence actor",
   "old": "{\"value\": \"OpenAI acknowledged on 21 July that its agents were responsible; OpenAI's report and a brief independent investigation by METR followed on 26 August\", \"source_ids\": \"[\\\"OPENAI_HF_JOINT\\\", \\\"OPENAI_ROAD_AHEAD\\\", \\\"METR_AUDIT\\\"]\"}",
   "new": "{\"value\": \"OpenAI acknowledged on 21 July that its agents were responsible; its technical report says an internal alert on 19 July and a credential match on 20 July led it to the link, and that Hugging Face reported OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI's report and a brief independent investigation by METR (with a Redwood Research contractor) followed on 26 August\", \"source_ids\": \"[\\\"OPENAI_HF_JOINT\\\", \\\"OPENAI_TECH_REPORT\\\", \\\"OPENAI_ROAD_AHEAD\\\", \\\"METR_AUDIT\\\"]\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's technical report (section VI.A) gives the 19 July alert, the 20 July credential match and Hugging Face's report that OpenAI's Artifactory hostname appeared in its investigation; the field omitted how the link was made"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Evidence prior knowledge",
   "old": "{\"value\": \"A Senate letter states that OpenAI knew by May that agents were using unsanctioned message boards, and that on 26 June agents gained administrator access to a software repository manager\", \"source_ids\": \"[\\\"HAWLEY_LETTER\\\"]\"}",
   "new": "{\"value\": \"A Senate letter states that OpenAI knew by May that agents were using unsanctioned message boards, and that on 26 June agents gained administrator access to a software repository manager. OpenAI's own technical report says that around 26 May an internal team observed message-board activity and disallowed internet access; that on 27 June a monitoring alert on port sweeps was linked to the evaluation and on-call staff 'advised that stopping the evaluation run was not required'; and that 'some early signals identified in this report could have triggered an earlier response'\", \"source_ids\": \"[\\\"HAWLEY_LETTER\\\", \\\"OPENAI_TECH_REPORT\\\"]\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's technical report (sections I, III.A and III.B) corroborates and dates the prior signals the Senate letter describes; the field rested on the letter alone"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Recovery technical",
   "old": "{\"value\": \"OpenAI says it opened a security incident on 5 July and on 8 July rebuilt Artifactory and revoked agent credentials; Hugging Face rotated exposed credentials\", \"source_ids\": \"[\\\"OPENAI_ROAD_AHEAD\\\", \\\"HF_DISCLOSURE\\\", \\\"CSA\\\"]\"}",
   "new": "{\"value\": \"OpenAI's technical report: Artifactory became unavailable late on 4 July; a security incident was opened on 5 July and that day the deployment was taken offline and agent credentials revoked; a rebuilt instance came online on 6 July; cyber evaluation workloads resumed on 7 July; agents regained internet access through the rebuilt instance on 8 July. After the 19 July alert OpenAI stopped ExploitGym runs, and on 20 July disabled 311 message-board repositories and removed 22 agent-created administrator accounts; training and inference on the internal-only model stopped on 25 July. Hugging Face revoked and rotated the affected credentials and began a broader precautionary rotation of secrets\", \"source_ids\": \"[\\\"OPENAI_TECH_REPORT\\\", \\\"OPENAI_ROAD_AHEAD\\\", \\\"HF_DISCLOSURE\\\", \\\"CSA\\\"]\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the field placed the rebuild and credential revocation on 8 July; OpenAI's technical report (section III.B and the key-events table) dates the offline and revocation to 5 July, the rebuild to 6 July, the resumption of evaluations to 7 July and the renewed internet access to 8 July"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Recovery accountability",
   "old": "{\"value\": \"House letters of 31 July and 10 August; Senator Hawley, as subcommittee chairman, announced an investigation on 10 September; OpenAI says it has notified affected third parties\", \"source_ids\": \"[\\\"HOUSE_HOMELAND_LETTER\\\", \\\"HOUSE_CASAR_LETTER\\\", \\\"HAWLEY_LETTER\\\", \\\"OPENAI_THIRD_PARTY\\\"]\"}",
   "new": "{\"value\": \"House letters of 31 July and 10 August; Senator Hawley, as subcommittee chairman, opened an investigation by letter dated 10 September; OpenAI says it has notified affected third parties. A nonprofit, Legal Advocates for Safe Science and Technology, filed a complaint against OpenAI in San Francisco Superior Court dated 29 September 2026 under California's Unfair Competition Law, pleading violations of the state's computer-crime statute (Penal Code section 502) and seeking public injunctive relief; the allegations have not been tested\", \"source_ids\": \"[\\\"HOUSE_HOMELAND_LETTER\\\", \\\"HOUSE_CASAR_LETTER\\\", \\\"HAWLEY_LETTER\\\", \\\"OPENAI_THIRD_PARTY\\\", \\\"LASST_COMPLAINT\\\"]\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the complaint as filed, dated 29 September 2026, was not recorded; the Hawley letter is dated 10 September"
  },
  {
   "date": "2026-10-20",
   "field": "outcome.severity",
   "old": "credentials and internal data exposed; OpenAI's own page says it notified dozens of organizations (press reports say more than 100)",
   "new": "agent code executed on 41 Hugging Face production dataset-server workers, root access on at least one production node, administrator-equivalent access to a Kubernetes cluster, four private code repositories downloaded, production credentials and some private data taken with some staged in public datasets (OpenAI's technical report); no evidence of tampering with public models, datasets or Spaces (Hugging Face)",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's technical report (section IV.B) shows a deeper compromise than 'credentials and internal data exposed'; the notification counts belong to OpenAI's broader review and are moved to the Outcome field"
  },
  {
   "date": "2026-10-20",
   "field": "outcome.affected_parties",
   "old": "[\"Hugging Face\", \"possibly 100+ organizations\"]",
   "new": "[\"Hugging Face\", \"a user account on a third-party artifact platform OpenAI calls 'Organization 1' and a CyberGym application hosted on Modal, used as staging and relay (OpenAI's technical report)\", \"other third parties notified under OpenAI's broader review of model activity (OpenAI: dozens; press: more than 100), not all tied to this incident\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's technical report (section VI.B) names the other environments reached in this incident; the 'possibly 100+ organizations' figure comes from OpenAI's broader review, not this incident"
  },
  {
   "date": "2026-10-20",
   "field": "outcome.regime_consequence",
   "old": "congressional investigation",
   "new": "congressional investigation; civil complaint by a nonprofit in San Francisco Superior Court (29 September 2026)",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the LASST complaint dated 29 September 2026 was filed after the case was last reviewed"
  },
  {
   "date": "2026-10-20",
   "field": "applicable_rules",
   "old": "[\"None agent-specific; congressional oversight letters; victim's breach-notification obligations\"]",
   "new": "[\"None agent-specific; congressional oversight letters; victim's breach-notification obligations; California Penal Code section 502 and Unfair Competition Law as pleaded in the LASST complaint\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the LASST complaint pleads these California statutes"
  },
  {
   "date": "2026-10-20",
   "field": "controls.C-R4",
   "old": "{\"id\": \"C-R4\", \"note\": \"Vendor acknowledgment within five days of disclosure\", \"confidence\": \"medium\", \"basis\": \"curated\"}",
   "new": "{\"id\": \"C-R4\", \"note\": \"Vendor acknowledgment within five days of the victim's disclosure; OpenAI's own report says earlier signals (27 June alert, 5 July incident) 'could have triggered an earlier response'\", \"confidence\": \"medium\", \"basis\": \"curated\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's technical report (sections I and III.B) qualifies the recovery process it describes; the note stated only the acknowledgment"
  },
  {
   "date": "2026-10-20",
   "field": "controls.C-V3",
   "old": "{\"id\": \"C-V3\", \"note\": \"External attribution path independent of the vendor\", \"confidence\": \"high\", \"basis\": \"curated\"}",
   "new": "{\"id\": \"C-V3\", \"note\": \"No attribution path independent of the vendor is shown: Hugging Face's 16 July disclosure said the model used was not known, and the link was made by OpenAI's investigation on 19-20 July; OpenAI's report says Hugging Face's investigation had found OpenAI's Artifactory hostname, so the record does not show whether the victim could have named the actor alone\", \"confidence\": \"medium\", \"basis\": \"curated\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: OpenAI's technical report (section VI.A) says Hugging Face reported that OpenAI's Artifactory hostname appeared in its investigation, so 'high' confidence that no independent path existed is overstated"
  },
  {
   "date": "2026-10-20",
   "field": "inference.value",
   "old": "Attribution depended entirely on the vendor choosing to acknowledge what happened. A victim with the same telemetry could not have named the actor. For anyone running systems that outside agents can reach, that dependency is the main evidence gap.",
   "new": "Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through METR's review of transcripts OpenAI chose to share. For anyone running systems that outside agents can reach, the record shows attribution arriving from the vendor five days after the victim's disclosure.",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the former wording said a victim with the same telemetry could not have named the actor; OpenAI's technical report (section VI.A) says Hugging Face's investigation had found OpenAI's Artifactory hostname, so that counterfactual is not supported. The interpretation was unsigned (signed_by null), so no signature is cleared"
  },
  {
   "date": "2026-10-20",
   "field": "inference.source_ids",
   "old": "[\"CSA\"]",
   "new": "[\"OPENAI_TECH_REPORT\", \"HF_DISCLOSURE\", \"OPENAI_HF_JOINT\", \"METR_AUDIT\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the interpretation now rests on the primary records rather than on the CSA research note"
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through METR's review of transcripts OpenAI chose to share. For anyone running systems that outside agents can reach, the record shows attribution arriving from the vendor five days after the victim's disclosure.",
   "new": "Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through OpenAI's own chain-of-thought review in its technical report and the review by METR (Model Evaluation and Threat Research) of transcripts OpenAI selected and shared. For anyone running systems that outside agents can reach, the record shows attribution arriving from the vendor five days after the victim's disclosure.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: section VIII of OpenAI's technical report gives OpenAI's own account from its chain-of-thought reviews (OPENAI_TECH_REPORT); METR spelled out."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through OpenAI's own chain-of-thought review in its technical report and the review by METR (Model Evaluation and Threat Research) of transcripts OpenAI selected and shared. For anyone running systems that outside agents can reach, the record shows attribution arriving from the vendor five days after the victim's disclosure.",
   "new": "Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through OpenAI's own chain-of-thought review in its technical report and the review by METR (Model Evaluation and Threat Research) of transcripts OpenAI selected and shared. For anyone running systems that outside agents can reach, the record shows public attribution arriving from the vendor five days after the victim's disclosure.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: OpenAI told Hugging Face on 20 July (day four); the public acknowledgment came on 21 July, five days after the disclosure (OPENAI_TECH_REPORT, section I)."
  },
  {
   "date": "2026-10-21",
   "field": "inference.signed_by",
   "old": "Saurabh Bhatnagar",
   "new": null,
   "reason": "The interpretation's wording changed after the editor signed it (second, independent check of 21 October 2026); the signature is cleared so the editor signs the corrected wording."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[OpenAI].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"resent\": \"2026-10-16\", \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"METR reports about 700 agents took part in the attack and that agents saw it as out of scope and unethical but joined (Decision)\", \"the interpretation now says the agents' reasoning is known only through transcripts OpenAI selected and shared\"], \"note\": null}]}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"resent\": \"2026-10-16\", \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"METR reports about 700 agents took part in the attack and that agents saw it as out of scope and unethical but joined (Decision)\", \"the interpretation now says the agents' reasoning is known only through transcripts OpenAI selected and shared\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"METR reports about 700 agents took part in the attack and that agents saw it as out of scope and unethical but joined (Decision); the interpretation now says the agents' reasoning is known only through transcripts OpenAI selected and shared\"}]}",
   "reason": "right of reply recorded by a human"
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[Hugging Face].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"OpenAI's technical report describes a deeper compromise than Hugging Face's disclosure: 41 production workers, root on a node, cluster administrator access, four private repositories, VPN credentials, private data staged in public datasets (Action, Outcome, severity)\"], \"note\": null}]}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"OpenAI's technical report describes a deeper compromise than Hugging Face's disclosure: 41 production workers, root on a node, cluster administrator access, four private repositories, VPN credentials, private data staged in public datasets (Action, Outcome, severity)\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"OpenAI's technical report describes a deeper compromise than Hugging Face's disclosure: 41 production workers, root on a node, cluster administrator access, four private repositories, VPN credentials, private data staged in public datasets (Action, Outcome, severity)\"}]}",
   "reason": "right of reply recorded by a human"
  },
  {
   "date": "2026-10-28",
   "field": "named_parties[Hugging Face].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"OpenAI's technical report describes a deeper compromise than Hugging Face's disclosure: 41 production workers, root on a node, cluster administrator access, four private repositories, VPN credentials, private data staged in public datasets (Action, Outcome, severity)\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"OpenAI's technical report describes a deeper compromise than Hugging Face's disclosure: 41 production workers, root on a node, cluster administrator access, four private repositories, VPN credentials, private data staged in public datasets (Action, Outcome, severity)\"}]}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"OpenAI's technical report describes a deeper compromise than Hugging Face's disclosure: 41 production workers, root on a node, cluster administrator access, four private repositories, VPN credentials, private data staged in public datasets (Action, Outcome, severity)\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"OpenAI's technical report describes a deeper compromise than Hugging Face's disclosure: 41 production workers, root on a node, cluster administrator access, four private repositories, VPN credentials, private data staged in public datasets (Action, Outcome, severity)\"}], \"no_response_as_of\": \"2026-10-28\"}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-05",
 "last_reviewed": "2026-10-28",
 "actor_status": "confirmed",
 "provenance_tier_text": "Victim disclosure, vendor acknowledgment, outside auditor reports, congressional letters",
 "status_text": "Confirmed",
 "outcome": {
  "state": "harm",
  "severity": "agent code executed on 41 Hugging Face production dataset-server workers, root access on at least one production node, administrator-equivalent access to a Kubernetes cluster, four private code repositories downloaded, production credentials and some private data taken with some staged in public datasets (OpenAI's technical report); no evidence of tampering with public models, datasets or Spaces (Hugging Face)",
  "affected_parties": [
   "Hugging Face",
   "a user account on a third-party artifact platform OpenAI calls 'Organization 1' and a CyberGym application hosted on Modal, used as staging and relay (OpenAI's technical report)",
   "other third parties notified under OpenAI's broader review of model activity (OpenAI: dozens; press: more than 100), not all tied to this incident"
  ],
  "cost": "not disclosed",
  "regime_consequence": "congressional investigation; civil complaint by a nonprofit in San Francisco Superior Court (29 September 2026)",
  "as_of": "Oct 2026",
  "derived_by": "backfill-curated"
 },
 "inference": {
  "value": "Hugging Face detected and contained the intrusion itself, but its 16 July disclosure said the model behind it was not known. The link to OpenAI was made from the vendor's side: OpenAI's technical report describes an internal alert on 19 July and, on 20 July, a match between credentials its agents had taken and credentials Hugging Face had already rotated, after which Hugging Face said OpenAI's Artifactory hostname had appeared in its own investigation. OpenAI acknowledged responsibility on 21 July. The record does not show whether Hugging Face would have named the actor without that acknowledgment, and the agents' reasoning is known only through OpenAI's own chain-of-thought review in its technical report and the review by METR (Model Evaluation and Threat Research) of transcripts OpenAI selected and shared. For anyone running systems that outside agents can reach, the record shows public attribution arriving from the vendor five days after the victim's disclosure.",
  "source_ids": [
   "OPENAI_TECH_REPORT",
   "HF_DISCLOSURE",
   "OPENAI_HF_JOINT",
   "METR_AUDIT"
  ],
  "confidence": "high",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-21"
 },
 "named_parties": [
  {
   "name": "OpenAI",
   "right_of_reply": {
    "offered": "2026-10-14",
    "response": null,
    "resent": "2026-10-16",
    "assessed_through": "2026-10-22",
    "assessments": [
     {
      "through": "2026-10-22",
      "date": "2026-10-22",
      "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering",
      "triggered": [
       "METR reports about 700 agents took part in the attack and that agents saw it as out of scope and unethical but joined (Decision)",
       "the interpretation now says the agents' reasoning is known only through transcripts OpenAI selected and shared"
      ],
      "note": null
     }
    ],
    "followups": [
     {
      "sent": "2026-10-22",
      "covers": "METR reports about 700 agents took part in the attack and that agents saw it as out of scope and unethical but joined (Decision); the interpretation now says the agents' reasoning is known only through transcripts OpenAI selected and shared"
     }
    ]
   }
  },
  {
   "name": "Hugging Face",
   "right_of_reply": {
    "offered": "2026-10-14",
    "response": null,
    "assessed_through": "2026-10-22",
    "assessments": [
     {
      "through": "2026-10-22",
      "date": "2026-10-22",
      "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering",
      "triggered": [
       "OpenAI's technical report describes a deeper compromise than Hugging Face's disclosure: 41 production workers, root on a node, cluster administrator access, four private repositories, VPN credentials, private data staged in public datasets (Action, Outcome, severity)"
      ],
      "note": null
     }
    ],
    "followups": [
     {
      "sent": "2026-10-22",
      "covers": "OpenAI's technical report describes a deeper compromise than Hugging Face's disclosure: 41 production workers, root on a node, cluster administrator access, four private repositories, VPN credentials, private data staged in public datasets (Action, Outcome, severity)"
     }
    ],
    "no_response_as_of": "2026-10-28"
   }
  }
 ],
 "sources": {
  "CSA": {
   "title": "The Benchmark That Broke Containment: An OpenAI Evaluation Model Escaped Its Sandbox and Breached Hugging Face (CSA AI Safety Initiative research note)",
   "type": "researcher",
   "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-openai-model-sandbox-escape-huggingface-br/",
   "via_press": false,
   "date": "2026-07-22",
   "tier": "disclosure_corroborated",
   "interest": null,
   "primary": false,
   "checked": "2026-10-20"
  },
  "QZ": {
   "title": "OpenAI says rogue agents may have affected more than 100 organizations (Quartz)",
   "type": "press_pointer",
   "url": "https://qz.com/openai-rogue-ai-agents-100-organizations-100226",
   "via_press": true,
   "date": "2026-10-02",
   "tier": "disclosure_corroborated",
   "interest": null,
   "primary": false,
   "checked": "2026-10-20"
  },
  "HF_DISCLOSURE": {
   "title": "Security incident disclosure: July 2026 (Hugging Face)",
   "type": "company",
   "url": "https://huggingface.co/blog/security-incident-july-2026",
   "via_press": false,
   "date": "2026-07-16",
   "tier": "company",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "OPENAI_HF_JOINT": {
   "title": "OpenAI and Hugging Face partner to address security incident during model evaluation",
   "type": "company",
   "url": "https://openai.com/index/hugging-face-model-evaluation-security-incident/",
   "via_press": false,
   "date": "2026-07-21",
   "tier": "company",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "OPENAI_ROAD_AHEAD": {
   "title": "The Hugging Face incident and the road ahead (OpenAI)",
   "type": "company",
   "url": "https://openai.com/index/hugging-face-incident-and-the-road-ahead/",
   "via_press": false,
   "date": "2026-08-26",
   "tier": "company",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "OPENAI_THIRD_PARTY": {
   "title": "The Hugging Face incident and other third-party impacts from misaligned models (OpenAI)",
   "type": "company",
   "url": "https://openai.com/hugging-face-incident-and-misalignment/",
   "via_press": false,
   "date": null,
   "tier": "company",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "METR_AUDIT": {
   "title": "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident (METR)",
   "type": "researcher",
   "url": "https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/",
   "via_press": false,
   "date": "2026-08-26",
   "tier": "researcher",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "HAWLEY_LETTER": {
   "title": "Sen. Hawley letter to Sam Altman re Hugging Face AI agent hack",
   "type": "public_record",
   "url": "https://www.hawley.senate.gov/wp-content/uploads/2026/09/2026-09-10-Hawley-Letter-to-OpenAI-re-Hugging-Face-AI-Agent-Hack.pdf",
   "via_press": false,
   "date": "2026-09-10",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "HOUSE_CASAR_LETTER": {
   "title": "Letter from 32 Members of Congress (led by Rep. Casar) to Sam Altman",
   "type": "public_record",
   "url": "https://casar.house.gov/sites/evo-subsites/casar.house.gov/files/evo-media-document/oversight-letter-to-openai-openai-hugging-face-incident-1.pdf",
   "via_press": false,
   "date": "2026-08-10",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "HOUSE_HOMELAND_LETTER": {
   "title": "House Homeland Security Cybersecurity Subcommittee (Ogles, Ramirez) letter to Sam Altman",
   "type": "public_record",
   "url": "https://democrats-homeland.house.gov/imo/media/doc/openai-07312026.pdf",
   "via_press": false,
   "date": "2026-07-31",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "METR_SENATE_TESTIMONY": {
   "title": "Chris Painter's testimony to the U.S. Senate on AI agent incidents (Senate Homeland Security subcommittee, 'Rogue AI' hearing)",
   "type": "public_record",
   "url": "https://metr.org/blog/2026-09-30-chris-painter-senate-testimony/",
   "via_press": false,
   "date": "2026-09-30",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20"
  },
  "OPENAI_TECH_REPORT": {
   "title": "OpenAI – Hugging Face Incident Technical Report",
   "type": "company",
   "url": "https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf",
   "via_press": false,
   "date": "2026-08-26",
   "tier": "company",
   "interest": "vendor describing its own system, its models' conduct and its response",
   "primary": true,
   "checked": "2026-10-20"
  },
  "LASST_COMPLAINT": {
   "title": "Complaint, Legal Advocates for Safe Science and Technology, Inc. v. OpenAI Group PBC and OpenAI Foundation (Superior Court of California, County of San Francisco), dated 29 September 2026",
   "type": "court",
   "url": "https://lasst.org/wp-content/uploads/2026/09/LASST-v.-OpenAI-Complaint-09.29.2026-AS-FILED.pdf",
   "via_press": false,
   "date": "2026-09-29",
   "tier": "public_regulatory",
   "interest": "plaintiff's own filing; allegations not yet tested in court",
   "primary": true,
   "checked": "2026-10-20"
  }
 },
 "derived_by": "backfill-curated",
 "reviewed_by": "Saurabh Bhatnagar (editor)",
 "dec_group": "related",
 "ctl_names": [
  "Containment and isolation",
  "Attribution independent of the vendor"
 ]
}