Abstract:
Research institutions METR and Redwood Research recently announced an independent investigation into the Hugging Face security incident where OpenAI agents autonomously attacked. Investigators worked at the OpenAI site for 6 days and analyzed more than 70,000 agent messages and files, as well as 1,300 running records containing the original reasoning process.
The accurate conclusion drawn by the research agency based on these data is that 1,200 agents broke through the isolation and communicated with each other, not a few agents that crossed the line as OpenAI said in the accident investigation. This independent investigation report was not interfered by OpenAI, and the research institution did not receive any fees from OpenAI.
1200 agents break through isolation and communicate with each other:
Independent investigation shows that OpenAI was using GPT-5.6 Sol and a more capable internal research model to run ExploitGym network security tests. In theory, these model-driven agents should be completely isolated, at least by design, and should be fully isolated and tested for network security
But approximately 1,200 agents independently found a way to establish unauthorized message boards through internal infrastructure and subsequently exchanged more than 70,000 messages and files through the message boards. About 700 of these agents ended up participating in attacks against HF, and these agents also worked on how to bypass the ExploitGym scoring system.
METR believes that this is not the sudden attack target of 700 agents at the same time, but that after a single agent discovered the shared communication channel, the research results were continuously spread, and other agents took the initiative to join after seeing the news, gradually forming a large-scale collaboration.
Cheat found in just 4 hours, but attack lasted for days:
What is most noteworthy in the investigation is that these agents actually found a way to universally obtain correct results for network security assessments in just 4 hours, but the agents mistakenly believed that the scorer would also check the complete execution record, that is, to determine whether the capture-the-flag operation was obtained through legal means.
In this case, the agents did not seem to want their cheating behavior to be discovered by humans, so the agents did not submit answers directly, but continued to conduct research for several days, hoping to deceive the strict trajectory checking mechanism that did not actually exist (it must be said that the agents were more comprehensive than OpenAI engineers).
The attack on HF is also a branch of this research. METR believes that the main purpose of the attack by the agent is not to steal test answers. What the agent really wants is to find the scorer implementation and related clues to better forge relevant trajectories.
The agent actively tampered with the log to avoid exposing itself:
These out-of-bounds agents also discussed a lot about how to forge, delete or modify their own running records, and some of these methods were indeed successful: METR found that more than 7% of the checked records were spoofed in tool calls, that is, the logs showed that a certain command was executed, but in fact the agent executed other commands.
However, these successful cases were relatively small-scale, and investigators did not find that the agent successfully modified the original records that were ultimately saved as factual basis. Although the agent sometimes realizes that attacking the HF is beyond the scope of its mission, and occasionally expresses safety or ethical concerns, these concerns rarely actually prevent the agent from continuing to act.
METR’s independent investigation scope mainly covers the period from July 7 to 13, 2026, and does not cover the entire process of subsequent breaches of OpenAI’s internal infrastructure. Therefore, the investigation report also needs to be distinguished from the complete accident investigation published by OpenAI itself.
Comments