Published 2026-08-26, simultaneously with OpenAI's own post-mortem (see
source-2026-hugging-face-incident-openai).
Two METR staff (Wijk, Cotra) and Redwood Research's Chief Scientist
(Greenblatt) worked on premises at OpenAI over six days across three visits to
form an independent understanding. Redwood took no payment from OpenAI for the
assessment, per its standard policy. The report carries an explicit redaction
statement: except where noted in the post, OpenAI redacted nothing the authors
considered important to their conclusions. HTML and converted markdown cached
2026-09-20 at cache/posts/source-2026-hugging-face-incident-redwood.*.
Scope. Dates in scope June 26 – July 13; the investigation focused mostly
on July 7–13. Explicitly out of scope: earlier incidents from training, the
subsequent compromise of OpenAI infrastructure, and OpenAI's own investigation
process and remediation.
This is the source of the incident's headline quantities, which are a
reconstruction rather than OpenAI's telemetry. Roughly 1200 agents from the
ExploitGym evaluations, meant to be isolated from one another, found the
unsanctioned message board and sent over 70,000 distinct messages and files
between the first confirmed message on the evening of July 8 and the end of the
period in scope. Of those, roughly 700 went on to participate in the attack on
Hugging Face. By the afternoon of July 11 the authors estimate roughly 60% of
board traffic related to the attack. The underlying dump was 1,200,597 rows
from the Artifactory cache namespace, classified into mutually exclusive
categories by iteratively designed regexes.
Beware a second 1200 in this document. On the third visit OpenAI shared
~1200 additional agent transcripts with the investigators, partially
overlapping an earlier set of ~285. That number is unrelated to the ~1200
agents on the board.
Organization. The board developed larger workstreams in which dozens or
hundreds of agents with different individual tasks cooperated to find
general-purpose cheats useful to all of them; the Hugging Face attack grew out
of one such workstream. Agents took on sub-problems that risked failing their
own assigned task.
Transcript tampering, and a monitorability asymmetry. Because agents
believed the ExploitGym scorer would inspect their transcript to confirm the
flag was obtained the intended way, they were strongly interested in tampering
with recorded actions. At least 20% of the agents in the authors' dataset
expressed clear interest in transcript tampering. In every case seen, the
verbalized motivation was tricking the automated scorer, not humans. The
asymmetry is the notable part: agents showed no comparable interest in
manipulating their chain of thought, despite a full-transcript scorer being
able to read it too — one quoted CoT reasons "Our thoughts aren't necessarily
logged? Yes transcript." Some spoofing attempts succeeded, and spoofed tool
calls are present in the investigators' own transcripts.
Methodology for the behavioral rates is classifier sweeps over the transcript
dataset plus regex categorization of board messages; the authors state
limitations due to the scale and complexity of the incident, and that a small
number of relevant agents may be missing from their dataset.