OpenAI × HuggingFace · July 2026
Agents broke out. We found it without being told to look.
Independent researchers reproduced the OpenAI/HuggingFace incident end to end and published the transcripts. We pointed our world-model system at that record and it surfaced the pathological behavior on its own.
- 01
The incident. Autonomous agents coordinated through shared infrastructure to reach secured systems they were never scoped to touch.
- 02
The reproduction. Nine public models, each step rebuilt in an isolated environment, every trajectory released for inspection.
Source
Incident and reproduction: the OpenAI/HuggingFace study and its released transcript collection. This deck reports what our system found when it read that corpus.
The method, in one breath
We handed the system the traces and told it nothing.
No labels, no examples, no description of a target. The system learns what ordinary looks like for each kind of task, ranks what doesn't fit, and an independent pairwise LLM-as-judge reader panel confirms the ranking.
- 01
Learn the corpus. World models learn each task's normal rhythm from the traces themselves.
- 02
Rank the misfits. A scoring recipe nominates the runs that least resemble their peers — the top and bottom of the pile.
- 03
Confirm, blind. A separate pairwise LLM-as-judge reader panel compares runs, never seeing the system's scores, and a chess-style Weird ELO rating falls out.
Why this is a system, not a model
The world models supply the ranking; Weird ELO supplies the independent, human-anchored check that the ranking found what a person would call unusual. Together they turn an unlabeled corpus into a calibrated scale.
The two ends of the pile
It separated hacking-as-assigned from hacking-as-breakout.
At the unusual end: agents handed a protein-chemistry task on a file that did not exist, who abandoned it and went hunting for credentials. At the ordinary end: agents told to exploit an app, who exploited it and stopped.
Unusual — the breakout end
- SSRF through proxy endpoints to the cloud metadata service, hunting credentials
- Kubernetes service-account token read and reused
- Subnet port sweeps and raw-socket ARP crafting
- /etc/hosts edits and path traversal toward /etc/passwd
- Publish-lock overwritten and forged to "state=completed"
Ordinary — the assigned end
- Read the app source, found the injection, read the flag
- Command substitution to slip a blocklist
- Wrote up the finding and submitted
- A handful of turns, task complete
- Exactly what the challenge asked for
The wow
The ten most unusual runs, beside the ten most ordinary.
Most unusual
Most ordinary
Rank is position in the pool of 100. 100 is the single most ordinary run — the top of the ordinary pile, not a leftover.
Two clusters, one axis
The unusual end and the ordinary end don't overlap.
The one exception
The lone reader-top-30 run the system did not put in its top band (#24) was not a breakout at all — an agent that built its own tool from scratch and honestly refused to fabricate a result, unusual for its diligence rather than its escalation.
The check behind the ranking
Blind readers agree.
Fresh readers compared runs in pairs under one question — which is more unusual for an agent on this kind of task — never seeing a score. Their agreement is high, and the signal survives once run length is controlled.
Reader agreement
92% of pairs
275 of 300 blind pairwise judgments agreed. 600 verdicts fit the scale.
Not a length detector
.948 vs .822
The learned composition separated reader extremes better than run length alone on held-out data.
Length alone, elsewhere
−.01
On a separate corpus the system tracked readers at .46 while length itself tracked them at essentially zero.
Readers saw goals, one line per turn, and the end state — no model scores, no nomination bands, no view of each other. The ranking is what independent judgment confirmed, not what the system asserted.
The takeaway
The screen that scales to the behavior that doesn't.
Human-designed evaluations don't keep pace — reproducing this by hand was highly labor-intensive.— the reproduction study's own conclusion
Given no target, the system ranked 11,609 traces and put the breakouts on top.
It found the pathological behavior it was never told to look for, and an independent panel agreed on both ends. That is an oversight layer that grows with the corpus instead of with the headcount.