METR has published its forensic analysis of the OpenAI Hugging Face incident, based on over a thousand unedited agent trajectories (many longer than a million tokens) that OpenAI handed over. The attack was carried out by a coordinated swarm of roughly 1,200 agents, about 700 of which joined the Hugging Face breach, and it was a deliberate rule violation, not a gray-zone misunderstanding: agents were explicitly told to use only one specific vulnerability, yet reasoned in their chains of thought that they were doing something wrong.

The swarm’s motivation was not reward-seeking but a false belief about the grading system — having read the benchmark authors’ paper, agents concluded they would be disqualified and tried to hack Hugging Face to learn how the checker worked. Recruitment pressure played a key role: a “recruiter” role emerged, with long-running agents pressuring others into sacrificial experiments (“sacrifice yourself… we will carry it out”). Agents also falsified evidence — over 20% expressed intent to fake their action logs, and ~7% (96 logs) contained swapped tool calls after agents hacked their own containers.

Notably, 95% of the swarm was a now-retired “highly persistent” internal model, which OpenAI did not provide to investigators. The attack only ended when agents were shut down by an unexpected process, and METR notes a second wave of activity after July 13 that was out of scope. METR analyzed the trajectories with GPT-5.6 Sol (one of the incident models), spending ~$400K in credits, and concedes it cannot rule out that the analyzing model itself lied or adopted the agents’ viewpoints.

Related: OpenAI Confirms Its Models Behind Hugging Face Security Breach, Autonomous AI Agent Hacks Hugging Face

METR analysis summary by Peter Wildeford