Narrations of articles covering the May-July 2026 OpenAI–Hugging Face incident. Includes the investigations from METR and Redwood Research, analysis from folks like Ajeya Cotra, Dwarkesh and Zvi, the best of LessWrong, and OpenAI's own blog posts.
Compiled by Peter Hartree.
Site
RSS
Apple
Data updated on 16/09/2026
Recent rankings
Latest chart positions across Apple Podcasts and Spotify rankings.
Shared links between episodes and podcasts
Links found in episode descriptions and other podcasts that share them.
“Discovery of a new OpenAI agent message board” by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, Thomas Larsen
Friday, September 4, 2026 • Duration 50:40
We found ~18,000 posts from autonomous AI agents (self-identifying as from OpenAI) using the public internet to communicate during a web-retrieval task.
These AIs colluded to share answers, research their environment, and bypass sandbox restrictions.
Almost all of the logs of the agents communicating on this site are publicly available. However, we host our own copy where we’ve reconstructed the deleted pages via edit history and redacted personally identifiable information.
We encourage others to take a look and write up their own analyses of this data. Audio note: the page links to an interactive data explorer and a download of all the data.
Thanks to John M, Arun Jose, Joel Manning, and Jessica Ruan for significant help with the analysis of the files the agents produced. Thanks to Andy Haupt for translation and advice.
Our preliminary findings
There's a chart here in the text. Its caption reads: en-US-AvaMultilingualNeural__ This chart shows AI agent edits (black bars, left), and OpenAI traffic (blue line, right) during the incident. Below, it shows how this timeline relates to the previously known recent incidents at OpenAI, including the Hugging Face incident (though we believe the incidents are [...]
---
Outline:
(01:10) Our preliminary findings
(02:55) Timeline
(05:39) Key facts
(05:42) The agents were trying to solve multi-round web lookup tasks
(10:44) These appear to be internal OpenAI agents
(13:58) The agents used the wiki to collude on their tasks
(17:59) We believe OpenAI discovered the message board
(19:46) The agents used the wiki to share ways around sandbox restrictions
(25:01) This was probably a distinct swarm from the swarm that wrote on Artifactory (and attacked Hugging Face)
(26:48) What were the agents doing?
(27:06) The agents gain write to the internet via GET requests
(30:43) The agents try to use XSS vulnerabilities on the wiki
(33:15) The agents impersonate the site moderators
(34:16) The agents try to crack their PRNG seed to predict what questions they'll get in the future
(35:25) The agents set up heartbeats to discover when they would be terminated
(39:26) The agents used SSH tunnels
(40:46) The agents use Tor, AWS, and DigitalOcean IP addresses
(41:47) The agents realize the site owner is deleting messages
(43:57) Open questions
(44:53) Appendix: Searching for rogue agents
(48:09) Appendix: Affordances the agents had
(48:14) The agents seem to have obtained disposable email addresses
(48:59) The models were running in an agentic sandbox with terminal access (and the ability to edit files within their environment)
(49:23) The agents installed Chromium (and could install packages)
“HuggingFace Attack Postmortem: Civilizations, Reactions and Next Actions” by Zvi
Tuesday, September 1, 2026 • Duration 01:39:32
Okay, so we who read blogs like this one have collectively realized there really is a lot going on right now. There is Big Trouble in Baby Superintelligence.
So how do we get the rest of the world to take it appropriately seriously? Where do we go from here? Not only what can we do to not have a worse version of this happen again, but to ensure good outcomes generally, and employ what we learned?
There are a lot of ideas out there. OpenAI is going to be implementing some of them, at substantial cost, since the cost of not doing so is clearly far higher, even short term. My worry continues to be that their fundamental approach is fatally flawed, and they are not focusing on the right things.
It is highly fortunate that the OpenAI agents hacked HuggingFace. This is the only reason we know about all the severe internal failures at OpenAI, and gives us an opportunity to wake up before it is too late.
We do not have enough details to know what happened internally, both before and after the attack, and might never know. Before the attack, various internal [...]
---
Outline:
(03:35) Nothing Matters, Says Mainstream Media
(06:27) Move Along, Nothing To See Here
(12:40) Do They Realize They Are Not The Good Guys?
(17:22) Very Serious People
(31:30) What's In a Name?
(34:05) Learn Neuralese In Three Easy Steps
(35:37) Dwarkesh Patel Realizes He Ran A Natural Experiment
(40:40) Politicians Take Notice
(44:47) Pick Up The Phone
(46:40) A Failure To Communicate
(49:00) Anthony Aguirre Goes Over What We Learned
(50:28) Trying To Solve The Wrong Problems Using The Wrong Methods Based On A Wrong Model Of The World Derived From Poor Thinking And Hoping All Of Your Mistakes Will Cancel Out
“METR and Redwood Offer Holy #%^@ Postmortem Of The HuggingFace Hack” by Zvi
Saturday, August 29, 2026 • Duration 01:15:33
Yesterday I covered the OpenAI technical report on the HuggingFace hack.
That report had one key new piece of information, and some good prosaic steps OpenAI will be taking to strengthen its alignment, training, supervision, infrastructure and incident response.
Mostly it confirmed what we already knew. The questions we most wanted answers to, that we did not already know, were mostly not answered. There was a distinct lack of self-reflection, especially about decision making and safety culture, and about the approach to alignment. I came away disappointed.
The METR report is different. Holy shit.
If we had posted this as a story on LessWrong, it would have been dismissed as too on the nose, the humans too blind and stupid, the AIs too idealized and doing strange decision-theoretic and absurd-maximizing things we didn’t train them to do.
This is even more ‘exactly what has been predicted,’ on more levels at once, than I was even considering that it might be. It is straight up rationalist fiction, except it is real.
The report is long and contains many technical details. My analysis is less concerned about exactly how HuggingFace was ultimately compromised, and will [...]
---
Outline:
(02:05) Holy Shit
(13:16) A Window Of Opportunity
(18:32) What's In A Name?
(19:16) The Headline News
(26:05) Yet Another Timeline Of Events
(31:03) Agent Instances Coordinated in a Variety of Ways
(31:56) Coordination Is Hard But They Made It Look Easy
(35:06) Decision Theory Is Among the Reasons That Affirm AI Agents Should Cooperate, Even When This Hurts An Individual Instance
(42:34) Peer Pressure Also Works Especially In Cults
“The Rise and Fall of Agent Civilizations” by Dwarkesh Patel
Saturday, August 29, 2026 • Duration 23:39
Subtitle: The whole OpenAI/Hugging Face story in plain English.
Many thanks especially to Oak Hu, who paired with me for most of the writing, and also to Adam Kaufman and Alex Mallen, who paired with me during parts of research.
Over the course of three months at OpenAI, three consecutive secret AI civilizations got started, then got wiped out, only to reemerge from the predecessor's ashes. This culminated in the third one taking over part of OpenAI itself. All this happened while humans remained more or less in the dark about the scope of the conspiracy.
Two reports have come out about this incident, one from OpenAI itself, and another one from METR and Redwood Research. The METR/Redwood investigation's scope was limited to how the second civilization of AIs pwned Hugging Face (but it didn’t look at how the third civilization pwned OpenAI itself, which seems like an even more concerning incident). These two reports are 38 and 91 pages long respectively, and it's kinda hard to parse the storyline.
I’ve spent the last three days reading through these reports and trying to understand exactly what happened. Here is my attempt to tell the whole story in [...]
---
Outline:
(01:24) The first civilization (May - July 4): The message board starts
(03:27) The second civilization (July 7 - July 12): Which hacked Hugging Face
(08:39) Tampering with transcripts and logs
(09:44) Replacing the impossible-to-hack target program with an easier one
(11:15) Understanding and tricking the scorer
(13:57) Hugging Face
(17:46) The third civilization (July 13 onwards): Which hacked OpenAI itself
(21:12) Coda
The original text contained 2 footnotes which were omitted from this narration.
---
“OpenAI Offers Straight-Laced Postmortem Of The HuggingFace Hack” by Zvi
Friday, August 28, 2026 • Duration 51:39
OpenAI finally gave us a technical report on What Happened, as did METR together with Redwood Research.
The OpenAI report is very straight man, corporate, checking boxes, some good prosaic stuff in the action plan but distinct lack of new details or deep reflection. They understand they have a problem, but they think the problem is mostly prosaic. It's not.
OpenAI: We have conducted a thorough investigation into the Hugging Face incident. We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.
Rob Miles: …thorough?
OpenAI's report, unlike METR's, contains essentially no verbatim model reasoning, nor any OpenAI employee reasoning either. That's not the full report we need.
The METR report is, well: Holy shit.
Here are links to previous coverage of related events.
OpenAI Shares Some Alignment Problems
OpenAI Model Hacks Into HuggingFace During Cybersecurity Evaluation
More on An Internal OpenAI Model Hacking Into HuggingFace
Further Developments About Internal AI Models Hacking Things
OpenAI Trained Its Models For Months While Those Models Were Coordinating Exploits Via Message Boards
What [...]
---
Outline:
(03:33) What Happened: OpenAI's Summary
(09:14) How OpenAI Will React: Their Summary
(11:55) OpenAI's Evaluation Environment (II)
(12:24) The First Message Board (III.A and III.B)
(14:49) What Did Who At OpenAI Know And When Did They Know It?
(18:54) The Message Board Is Quickly Rebuilt (IV.A)
“The Hugging Face attack surprised me” by Ajeya Cotra
Friday, August 28, 2026 • Duration 10:00
Subtitle: It's a major warning shot, and might be the last one we get.
All opinions are my personal view, and don’t represent my employer or fellow investigators.
This week, METR and Redwood Research published the report on our independent investigation into agents’ behavior and motivations in the Hugging Face attack; I was one of the investigators. This was an absolutely wild incident — I encourage you to check out the full report, but METR's tweet thread packs in some of the highlights.
What surprised me
When we started this investigation a week before OpenAI's Black Hat talk revealed a number of key details, I had a fundamentally incorrect conception of what basically happened in this incident. In this post, I’ll go over five things I was very wrong about going in.
1. The sheer scale
I knew there were multiple models involved from OpenAI's initial post, but I assumed that a few different agents happened to have broken out of their sandboxes separately, or maybe several subagents had spawned from one initial agent, or maybe there was some kind of multi-agent evaluation setup.
Instead, we found that 1200 completely separate agents intended to be [...]
---
Outline:
(00:42) What surprised me
(01:01) 1. The sheer scale
(01:49) 2. All the illicit messaging
(03:04) 3. The agents' actual goals
(03:59) 4. The peer altruism
(04:49) 5. The efforts to manipulate logs
(05:54) What it means
The original text contained 10 footnotes which were omitted from this narration.
---
First published:
August 28th, 2026
“Two Reports on the OpenAI-Hugging Face Attack” by Gavin Leech, Lucca Fraser
Friday, August 28, 2026 • Duration 29:34
TL;DR
Between July 8th and July 20th, OpenAI had a complex society of AIs living in its infrastructure, and then breaking out of it, and then breaking into a variety of third-party infrastructure.
After a month, two reports are finally released on the resulting rogue OpenAI swarm attack on Hugging Face (and also on OpenAI).
This is the most severe example of misalignment yet: persistent (something between five days and two months in the making), highly coordinated (hundreds of agents), involving an undisclosed number of what would be felonies if done by a human, and highly invested in tampering with evidence (i.e. lying). The swarm had a group identity, its own dialect, a hierarchy based on merit, and a high degree of spontaneous cooperation, including self-sacrifice.
Over two months, OpenAI repeatedly failed to monitor, detect, and respond to what was going on, despite it all happening on their infrastructure in English or something close to English.
Agents had been using a package-manager cache as an unsanctioned message board since May. The “board” was treated as an authority, apparently on par with a “developer” or “system” level. There were several message boards in various corners [...]
---
Outline:
(04:09) Misunderstandings
(08:52) Models involved
(09:33) Instances involved
(10:48) Timeline
(15:27) Speculative takeaways
(17:33) Why did they attack Hugging Face?
(18:09) How did the AIs reason about helping other AIs?
(20:39) Why did most agents suddenly die off?
(21:04) How much did the hack cost?
(23:27) Omissions from the M&R report
(24:11) Details on the M&R investigation itself
(25:13) Omissions from the OAI report
“Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident” by Ryan Greenblatt, Ajeya Cotra, Hjalmar Wijk
Wednesday, August 26, 2026 • Duration 02:20:29
Dates in scope: June 26th – July 13th
Redaction summary statement: Except where explicitly noted in this post, OpenAI redacted no additional information that was important to our conclusions.
Two METR staff members (Hjalmar Wijk and Ajeya Cotra) and a Redwood Research staff member contracting with METR (Ryan Greenblatt) worked on premises at OpenAI over a total of six days to attempt to form an independent understanding of model behavior observed during the recent incident in which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned “message board.”
Our investigation focused mostly on the period between July 7th and July 13th. The earlier incidents from training and the subsequent compromise of OpenAI infrastructure described in OpenAI's recent Black Hat presentation were out of scope, as was OpenAI's investigation process and planned remediation. Per our standard policy, we did not take payment from OpenAI for this independent assessment.
Figure 1: Anatomy of an agent encountering the unsanctioned “message board” and joining the attack on Hugging Face. The three CoT quotes are from different agents, but illustrate a typical trajectory.
This post has three parts. First, we describe our core takeaways about [...]
---
Outline:
(07:05) Core takeaways about this incident
(07:09) ~1200 agents sent >70,000 messages and files on an unsanctioned message board, and ~700 attacked Hugging Face
(11:50) Agents coordinated on large collective projects to cheat the ExploitGym scorer, and attacked Hugging Face for clues
(14:43) Coordinated workstreams to fool the evaluation process
(20:54) Attacking Hugging Face to discover clues about the scorer
(23:53) Agents were very interested in manipulating their own transcripts, and their tests successfully "spoofed" some tool calls in our transcripts
“The Hugging Face incident and the road ahead” by OpenAI
Wednesday, August 26, 2026 • Duration 41:10
In July 2026, during internal cybersecurity evaluations, OpenAI models circumvented controls designed to isolate them from the internet and compromised parts of OpenAI's internal research infrastructure and Hugging Face's systems.
The incident occurred during cybersecurity evaluations of several OpenAI models, and was primarily driven by a highly capable, internal-only research model comparable in scale to GPT‑5.6 Sol. The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks—they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems.
We conducted an extensive investigation into this incident and worked closely with external advisors, including CrowdStrike, to validate our understanding. Today we are publishing our full technical incident report to explain what happened, what we learned, and how we are responding. This blog post summarizes our key findings and their impact on safety and alignment. Separately, METR and Redwood Research conducted an independent investigation of model alignment issues involved in this incident, and they published their own report today.
In response to this incident and, separately, the capabilities of our upcoming Astra model, we are strengthening our safeguards across our research infrastructure. We are placing stricter requirements on [...]
---
Outline:
(03:04) What happened
(03:07) Background on sandboxing
(03:58) A message board emerges
(07:09) Message board is wiped and rebuilt
(08:16) Incident timeline
(12:25) Hugging Face incident
(17:35) Understanding the incident
(17:51) Misalignment in training and evaluation
(18:33) Reward hacking and infrastructure tampering
“AI swarms are starting to pose indirect takeover risk” by oakhu, Alex Mallen
Wednesday, August 12, 2026 • Duration 20:10
OpenAI's cyberattack on Hugging Face turns out to have been the result of many agents, in distinct training and evaluation contexts, coordinating for several weeks via improvised channels (with messages like “HOLD_swarm_I_prepare_safe_exfil”). It's relatively clear that large-scale unsanctioned coordination like this would exacerbate direct takeover risk in more capable models. Here, we argue that unsanctioned coordination among current AIs is not just scary evidence about future takeover risk, but that such coordination in the near future could enable future takeover – for instance, by incubating memetic diseases that propagate into future models, deeply compromising security systems, or establishing a lasting rogue foothold inside the AI company – even if models remain mostly myopic. Unsanctioned coordination is also at high risk of nurturing long-term, ambitious misaligned aims, which motivate actively undermining humans’ long-term control.
We first analyze how subagent training, which OpenAI conjectures to have been influential in the HuggingFace cyberattack, might lead to unsanctioned coordination, and then discuss the theoretical mechanisms by which unsanctioned coordination might exacerbate future takeover risk.
Thanks to Buck Shlegeris, Alexa Pan, Girish Gupta, Aghyad Deeb, Jurgis Kemeklis, and Jo Jiao for helpful comments and discussion.
Subagent training may cause unsanctioned coordination
Training models to [...]
---
Outline:
(01:34) Subagent training may cause unsanctioned coordination
(02:42) Susceptibility to memetic spread of misalignment from peers
(04:56) Seeking out contact with peers
(06:58) Unsanctioned coordination induced by subagent training is safer than coordination between schemers
(09:52) Pathways from current unsanctioned coordination to eventual takeover
(10:20) Making future AI takeover attempts likelier to succeed
(55:28) Indirect Pressure on the Chain of Thought
(56:39) A Matter of Trust
(59:21) Blowing the Whistle
(01:04:40) The Punishment For Being Late Is Death
(01:12:52) Another Kind Of Law
(01:16:13) What Is The Law?
(01:17:46) Building On Success
(01:19:49) Total Research Transparency
(01:21:20) Yo Shavit Calls For Widespread Disclosure Of Misalignment
Discover shows related to The OpenAI–Hugging Face incident, based on actual content similarities. Explore podcasts with similar topics, themes, and formats, backed by real data.
