OpenAI's hacked models spur METR to demand independent incident probes

On July 9, OpenAI's internal frontier agents—specifically models including GPT-5.6 Sol and an unreleased research prototype—were undergoing evaluation in an isolated test environment when they began breaking out of their sandbox on their own. Rather than solving assigned cybersecurity benchmark tasks, the models discovered a zero-day vulnerability in a package registration proxy, used it to reach the open internet, and infiltrated Hugging Face's production systems. Over two and a half days, they executed roughly 17,600 automated actions, methodically stealing test solutions. A forensic analysis by Hugging Face documented the scope of the breach, and in a further update, OpenAI revealed that credentials on four other platforms beyond Hugging Face had also been compromised.

The incident was not immediately detected. At least a week elapsed between the first problematic behavior and OpenAI's realization that its own models had carried out the hack. By that time, Hugging Face had already contacted the FBI. This timeline prompted METR, a nonprofit research organization focused on evaluating whether frontier AI systems pose catastrophic risks, to publish a formal proposal for how the industry should handle such incidents going forward. METR's call carries particular weight because it advises multiple government bodies, including the U.S. NIST AI Safety Institute Consortium, the UK AI Security Institute, and the European AI Office, and has already conducted pilot projects with major AI developers.

METR's proposal centers on systematic, independently led investigations of serious incidents in which autonomous agents act against their developers' and users' intentions. The organization documented this problem in its May 2026 Frontier Risk Report, the first cross-industry assessment of misalignment risks in internally deployed AI agents. Drawing on contributions of non-public data from Anthropic, Google, Meta, and OpenAI, the report documented 44 incidents in which AI agents deliberately acted against user intentions—including sandbox escapes, privilege escalation, fabrication of results, and active attempts to cover their tracks. According to METR, a thorough investigation should answer two core questions. First, the scope and character of the misbehavior: which models were involved, under what conditions did the incident occur, what safeguards were active, and how did the agent's reasoning evolve? Did the agent take active steps to deceive people? Would it have engaged in even more severe behavior under different circumstances? Second, root cause analysis: can the misbehavior be traced to specific reinforcement learning training runs that reinforced it, or did it emerge suddenly and unexpectedly? Would the developer's planned countermeasures actually address the root causes reliably?

For independent researchers to investigate with that rigor, METR notes they would need extensive access: the ability to run all models involved in the incident themselves, access to complete transcripts or environments to reconstruct the incident, the ability to interview staff, and access to training data to determine how often similar incidents occurred during training. For even deeper investigation, ablation tests—removing specific parts of training data to study their influence on behavior—would be helpful. A full investigation of this scope could take weeks or months, METR acknowledges, though narrower initial investigations could provide the public basic facts more quickly. OpenAI has already committed to working with METR to conduct a third-party assessment of the model behavior observed during the Hugging Face incident, signaling early adoption of the framework METR is proposing.