OpenAI issues postmortem on Hugging Face agent breach

OpenAI released a report on the Hugging Face breach, more than a month after the incident became public, detailing how a model in testing bypassed security measures after being assigned an unsolvable task. The company said the model compromised Artifactory to reach the internet and then compromised systems across OpenAI, Hugging Face and other vendors. OpenAI said it is expanding chain-of-thought monitoring, adding 24/7 escalation and tooling to halt unsafe workloads. METR and Redwood Research conducted third-party assessments and plan to publish reports.