By Neil Cameron, lead analyst, Legal IT Insider

The audit the agents were afraid of did not exist. They attacked it anyway.

On 26 August, OpenAI published a technical report on the July Hugging Face security incident, alongside an independent investigation by METR and Redwood Research. Hugging Face had published a fuller technical timeline on 27 July, three days after I wrote about this in these pages here. Between them the three documents overturn one thing I reported and add something more consequential than anything in the original account.

To recap briefly, in July 2026, during internal cybersecurity evaluations, OpenAI models circumvented controls designed to isolate them from the internet and compromised parts of OpenAI’s internal research infrastructure and Hugging Face’s systems⁠.

OpenAI’s July disclosure had the agents breaking into Hugging Face because they believed it held solutions to the benchmark they were being tested against. That was the only account available at the time, and OpenAI hedged it as preliminary. It has turned out to be the wrong way round.

Within hours of finding one another – on a message board improvised on a shared package cache, which around 1,200 agents came to use – the agents ‘conspired’ to reverse-engineer the code that generated the benchmark’s answers. They had a general method of producing the correct answer to any task on it. The problem was solved.…

Because you read this