We worked with METR and Redwood Research to conduct a third-party assessment of the model behavior observed during the incident.

They’re sharing a report of their findings: https://t.co/yw7LO11Xrk

Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident

Source: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/ **Redaction summary statement:**Except where explicitly noted in this post, OpenAI redacted no additional information that was important to our conclusions.

Two METR staff members (Hjalmar Wijk and Ajeya Cotra) and aRedwood Researchstaff member contracting with METR (Ryan Greenblatt) worked on premises at OpenAI over a total of six days1to attempt to form an independent understanding of model behavior observed during the recentincidentin which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned “message board.”

Our investigation focused mostly2on the period between July 7th and July 13th. The earlier incidents from training and the subsequent compromise of OpenAI infrastructure described inOpenAI’s recent Black Hat presentationwere out of scope, as was OpenAI’s investigation process and planned remediation. Per our standard policy,we did not take payment from OpenAI for this independent assessment.3

This post has three parts. First, we describe ourcore takeawaysabout the Hugging Face attack after conducting this investigation:

Second, we describe theinvestigation process and its limitations, which we believe is important for contextualizing our findings:

Finally, we providepreliminary answers to the seven specific questions in scopefor this investigation. In particular, we:

OpenAI agreed at the outset with METR and Redwood that we would be able to describe high-level scope and terms of our engagement in this post. Beyond that, OpenAI was able to redact any non-public information from this post. We worked with OpenAI to find mutually agreeable language to describe redactions where they occurred, and the redaction summary statement at the top of this post indicates whether or not we believe there was important information redacted that we were not able to agree on how to describe in the text of the post. OpenAI also gave additional feedback beyond redactions, and we made corrections and edits to structure, emphasis, clarity, and tone based on that feedback.5

OpenAI wrote their ownreport, informed in part by our investigation. We did not see OpenAI’s report prior to publication, and it was out of scope for this investigation to confirm claims in that report or the earlier Black Hat presentation.

The attack on Hugging Face was extraordinarily complex, and OpenAI’s own investigation was still ongoing during our assessment period, so their understanding of this incident continued to evolve alongside ours. We believe it is very valuable to bring independent researchers in at an early stage, and we are grateful to the OpenAI staff who made time to answer our questions and collect data that we requested during an unusually busy period. Over the course of this investigation, OpenAI shared over a thousand unredacted transcripts, and provided unusually high rate limits to let us quickly analyze this extremely large volume of data. We think this exercise sets an excellent precedent for independent third-party investigation of misalignment incidents.