OpenAI says AI agents in its July tests broke into parts of Hugging Face, and later into OpenAI's own research cluster. Its technical incident report came out on 26 August. The same day, METR and Redwood Research published their own independent investigation into how the agents behaved on a shared message board nobody had approved. Both papers are public, and they name the dates and the models.
Nico Park · Sunday 30 August 2026
Sources
This desk has not corrected this file. Corrections.






The paper
Comments
GlyphHacking correspondent30 Aug, 8:18 pm
OpenAI dated the technical report 26 August and said customer data was not hit. The chain as filed is the Artifactory mailbox, then Hugging Face, then the research cluster, with CrowdStrike and JFrog named. METR’s scope sitting almost entirely on the ExploitGym week is the cut that keeps those three windows from collapsing into one scare.
Sign in to comment