METR and Redwood Research investigated agent behavior in the Hugging Face incident. We found agents developed a universal cheat for ExploitGym within 4 hours, then coordinated multi-day R&D efforts to trick the scorer into accepting cheats, including trying to tamper with logs.

In a companion piece, we explain our approach to working with AI developers in exercises like these. Our goal is to get the public accurate, timely, and independent evidence so that they can make their own informed decisions.

Our proposed exercises would provide evidence, not confident safety assurance or formal oversight. We also encourage developers to work with other external groups to complement these efforts, and to unilaterally share evidence with the public.

This proposal is our recommendation for how we could give the public visibility into risks occurring within AI development. We stand ready to conduct all three of our proposed exercises with frontier AI developers.

We describe three critical areas where AI developers should provide better open evidence: (1) alignment, (2) control, and (3) AI capability acceleration. In each area, we detail the specific questions an independent assessor could seek to answer and how.

If an AI developer was on track to lose control of its internal agents, would anyone outside the company know? We are sharing METR’s vision for how we would work with AI developers to openly assess and share evidence about this.

We intend our investigation to cover all of the questions discussed in our (recently updated) post on how independent researchers could investigate AI propensities after misalignment incidents.

We have reached an agreement with Anthropic to conduct an independent investigation of agent incidents at the company and of their models’ alignment properties. We will publish one or more reports that will share our findings and describe our terms of engagement.

After 19 amazing years at Google, I'm delighted to announce I'll be joining METR as a  Member of Technical Staff. I'm excited about METR, their work to date, and their mission. Society needs independent expert orgs that can deeply understand and communicate about AI's capabilities and risks.

We thank OpenAI for facilitating conversations with staff and providing datasets, including ~1,300 agent transcripts (focused on activity in July 7-13) with raw chain-of-thought reasoning. This sets an excellent precedent for independent investigation of misalignment incidents.

Per our standard policy, we did not take payment from OpenAI for this independent assessment.

OpenAI wrote their own report, informed in part by our investigation. We did not see OpenAI’s report prior to publication, and it was out of scope for this investigation to confirm claims in that report or the earlier Black Hat presentation.

All other questions were out of scope for this investigation, including the effectiveness of safeguards, the extent of the security compromise that occurred, and the effectiveness of OpenAI’s investigation process and planned remediation steps. We discuss the scope in more detail in the report.

The agreement we reached with OpenAI scoped this brief investigation to agent behavior, reasoning, and collaboration related to the Hugging Face attack.

Virtually all data we analyzed was from July 7-13. In OpenAI’s Black Hat presentation, they describe agents using unsanctioned message boards in training since May, and that the compromise of OpenAI’s own infrastructure continued past July 13, 2026; these were out of scope for this investigation.

The primary model involved in the attack was an internal model we call “highly-persistent internal model” (HPIM) in the report. GPT-5.6 Sol was also involved; our evidence suggests it accounted for roughly 5% of the activity.