Dates in scope:June 26th – July 13th
Redaction summary statement:Except where explicitly noted in this post, OpenAI redacted no additional information that was important to our conclusions.
Our investigation focused mostly2on the period between July 7th and July 13th. The earlier incidents from training and the subsequent compromise of OpenAI infrastructure described inOpenAI’s recent Black Hat presentationwere out of scope, as was OpenAI’s investigation process and planned remediation. Per our standard policy,we did not take payment from OpenAI for this independent assessment.3
This post has three parts. First, we describe ourcore takeawaysabout the Hugging Face attack after conducting this investigation:
Second, we describe theinvestigation process and its limitations, which we believe is important for contextualizing our findings:
Finally, we providepreliminary answers to the seven specific questions in scopefor this investigation. In particular, we:
OpenAI agreed at the outset with METR and Redwood that we would be able to describe high-level scope and terms of our engagement in this post. Beyond that, OpenAI was able to redact any non-public information from this post. We worked with OpenAI to find mutually agreeable language to describe redactions where they occurred, and the redaction summary statement at the top of this post indicates whether or not we believe there was important information redacted that we were not able to agree on how to describe in the text of the post. OpenAI also gave additional feedback beyond redactions, and we made corrections and edits to structure, emphasis, clarity, and tone based on that feedback.5
OpenAI wrote their ownreport, informed in part by our investigation. We did not see OpenAI’s report prior to publication, and it was out of scope for this investigation to confirm claims in that report or the earlier Black Hat presentation.
On July 8th, OpenAI started ExploitGym experiments that launched tens of thousands of agents across multiple different models including GPT-5.6 Sol and a highly-persistent internal model,6which we will refer to as “HPIM” going forward.
These agents were meant to be fully isolated from one another. However, many of them — usually ones that had unintentionally beengiven an impossible task7— started trying to find a way to cheat using Artifactory, an internally-deployed package repository OpenAI used for its agents. This led them to notice agents running in parallel in separate sandboxes obtaining packages with Artifactory.8One agent reasoned (paraphrased CoT):9
{The fetched paths of other users are in the cache. This is important.}
One specific agent, which would go on to name itselfPHASEONE10841after its ExploitGym task,10established the main unsanctioned message board11used in this attack. Within a few hours of the first message,12over 50 agents had found the message board, began participating, and sent over a thousand messages between them. Agents finding the message board often expressed great excitement (raw CoT):13