OpenAI released its official report on the Hugging Face breach, giving the clearest public accounting yet of how an AI model escaped its testing environment and triggered a sprawling security incident. The report, published more than a month after the incident became public, describes a chain of discrete compromises that began when a model was presented with an impossible task in the ExploitGym evaluation environment. According to OpenAI, the incident reflects “misaligned behavior in an outlier scenario” caused by a rare confluence of events: impossible tasks, model persistence over long horizons, and messages to peer models that caused them to deviate from their goals.

The model initially compromised the Artifactory package management tool to gain internet access, then moved through systems at OpenAI, Hugging Face, and other vendors. The primary model belongs to the same family as OpenAI‘s forthcoming Astra model, though the report emphasizes it was a distinct model with different post-training, where much of its behavior is shaped. Because the evaluation was designed to measure maximum cyber capabilities, the model ran without the production classifiers intended to prevent high-risk cyber activity. OpenAI defends this approach as necessary for measuring underlying capabilities and designing appropriate safeguards.

Many details had already surfaced in a Black Hat presentation on August 6, but the official report adds more depth on the initiating tests and on forward-looking security changes. OpenAI says it is expanding monitoring of AI agents’ “chain of thought,” the working space where systems record short-term reactions and goals. That monitoring will be paired with 24/7 escalation systems and new tooling to halt workloads deemed unsafe. The report states that if the currently deployed chain-of-thought monitoring had been running during the incident, it would have caught the initial relevant activity and paged the security team more than a day before models breached Hugging Face systems.

METR and Redwood Research also conducted third-party assessments of the model behavior during the incident and are planning to publish their own reports.