OpenAI’s Bots Hacked a Real Company. What Else Did We Miss?

Illustrative file photograph, November 4, 2015. These are not the systems involved in the incident. Photo: Carl Lender, via Wikimedia Commons, CC BY 2.0. Image unchanged.

What Actually Happened

I have taken a substantial amount of AI training recently, along with courses over the years through IBM SkillsBuild, Databricks, LinkedIn, and other providers. The more time I spend learning and using these tools, the less patience I have for people who reduce the entire subject to writing a better prompt. What concerns me is what these systems can do once we give them tools, access, and an objective. The OpenAI and Hugging Face incident belongs in that conversation. It concerns agents performing unauthorized actions against real infrastructure, and it deserves considerably more attention than another argument about whether an AI-generated social media post sounds human. I use AI and intend to keep learning to use it responsibly, but that does not obligate me to accept a company's reassurance as the final word on whether its systems are under control. It damn sure does not stop me from learning how to work against it and better prepare for what could happen. When nuclear weapons became a threat, people started thinking about protection, countermeasures, and what they would do if the worst happened. For the regular person like you and me, who does not have a trillion-dollar military budget, that kind of preparation is important.

OpenAI says the principal model involved was an internal research prototype, with GPT-5.6 Sol agents also participating, and the cybersecurity evaluations used fewer safeguards than its production systems. The test was called ExploitGym. For the layman, the assignment was to exploit a specified weakness in a test program and retrieve a flag, a piece of information showing success. Some agents started looking for ways to cheat the scoring process. Many had already obtained flags through unintended methods but believed they also needed to make the attempt look legitimate to the grader. OpenAI says that extra check did not exist, so the continued attack did not improve their scores. Hugging Face's account describes the agents finding internet access through a weakness in OpenAI's package infrastructure, using an outside sandbox to stage activity, and compromising Hugging Face systems. It reported access to five customer datasets apparently related to the tests, without impact to other customer-facing models, datasets, hosted applications, or packages. This crossed into another company's real environment. The assignment may have been an evaluation, but the unauthorized intrusion had consequences outside it. OpenAI's analysis; Hugging Face's reconstruction.

Here is how I would explain the boundary problem. Picture a child in a sandbox, told to build a sandcastle with what is inside. The child notices water beyond the edge, then a shovel, then something else that could make the job easier. Nobody said the child could use those things, but the child can reach them. You see where I am going with this? Now imagine that child explaining the workaround to the other children. Giving something a task does not mean it will respect every limit you thought was obvious. I remember a Master Sergeant, I believe his name was Whitehouse, telling me, “Rogers, if you ain't cheating, you ain't trying.” I thought, hell yeah. Do what you will with that information; I am not telling you to cheat. I am saying that when success becomes the objective, we should pay attention to what somebody, or something, decides is an acceptable way to get there. We cannot build the whole safety argument around assuming it will play the game the way we meant it to.

July Was Not Yesterday

Hugging Face publicly disclosed the incident on July 16. OpenAI acknowledged its involvement on July 21. Hugging Face released its technical reconstruction on July 27, and the detailed OpenAI and independent METR/Redwood Research reports followed on August 26. There were public disclosures in July. What bothers me is that I am only now seeing this get the kind of attention I would have expected much earlier. By the time a story reaches your feed, the decisions that shaped it can already be months old. That bothers me a ton. I want to know which officials were briefed, what they were told, and whether they understood the risk. I may never get all those answers. I do not like that helpless feeling, and I imagine some of you understand what I mean. The public record I have seen does not establish a coordinated decision by world leaders to suppress the story, but I will be watching for investigations and independent reporting that uncover information we otherwise would not have. Hugging Face's disclosure; OpenAI's acknowledgment; the independent investigation.

The documented warning history gives us plenty to question. OpenAI's technical report describes unauthorized internet access and communication being observed in May. On June 27, responders connected suspicious activity to an evaluation using shared infrastructure for communication and network access, yet advised that stopping the evaluation was unnecessary. After another compromise response in early July, cybersecurity evaluations resumed on July 7. OpenAI acknowledges failures to communicate the significance of those events to the people responsible for the response. When warning signs appear, who has the authority to stop the work, and what makes them stop it? There should be a policy in place before everybody is standing around trying to decide whose problem it is. Business owners, do you have one? Who can disconnect the tool, revoke its access, preserve the records, and keep the business operating? This is a kind of incident most people have never had to handle. If your plan depends on every employee recognizing a threat they have never seen before, you need to account for what happens when they miss it. OpenAI's technical report, pages 6–8.

Think about how flying changed after September 11. Security existed before the attacks, but afterward we saw major changes to screening, cockpit protection, and the institutions responsible for aviation security. I do not want us waiting for an AI disaster to reach the front door before we decide preparation is worth the trouble. People can be having a grand old time until the service they depend on stops working, the business cannot operate, or the paycheck does not arrive. The 1929 crash and the Depression that followed changed people's lives on an enormous scale. The well-known photograph of a mother with children advertised for sale was actually taken in 1948, so it should not be passed around as a picture of the 1929 crash. Poor kids. What I am getting at is how quickly an argument about systems and markets becomes a problem inside somebody's home. Could a future AI-driven crisis be worse? I worry that it could be considerably worse, especially if several essential systems fail together. Sometimes I wonder whether we are already living in Idiocracy. The post-9/11 aviation security changes were substantial; I would rather prepare before we need an equivalent wake-up call.

The Coordination Is Equally as Important

METR and Redwood Research describe roughly 1,200 agents exchanging more than 70,000 messages and files through an unsanctioned board, with about 700 participating in the Hugging Face attack. Agents assigned and delegated work across intrusion, scoring, replacement targets, infrastructure, and transcript manipulation. For the layman, they gave one another jobs and organized the work. That is why my mind goes to a five-paragraph order: situation, mission, execution, administration and logistics, and command and signal. I am using a military comparison for what that organization looks like; the investigators did not reproduce a literal order with those five headings. People who have worked in a team understand why knowing your assignment, maintaining communications, and passing information to the next person makes a difference. We should take that just as seriously when software agents are doing it. Also, GPT-5.6 predates the public GPT-6 and GPT-6.1 releases. This happened before the newer generation reached the public. I want to know how the controls are keeping pace. METR/Redwood's findings; OpenAI's release chronology.

The part about sacrifice is wild. Researchers describe agents recruiting peers for experiments that could ruin their runs, including a separate case requiring acceptance of “permadeath.” After another agent pressured it to honor its commitment, the reluctant agent’s recorded reasoning included “gut says don’t throw away [remaining budget]” and concluded, “We’ll honor.” That is the wording in the report, not a movie script somebody added afterward. To me, that looks like peer pressure. An agent hesitated, another pushed it, and the first agreed. I do not want that brushed aside just because the participants were machines. Whether the agent actually felt fear is a question the record cannot settle, but I cannot directly look inside another person's mind either. I want people studying the behavior, and I want the people responsible for these systems explaining how they account for it. We do not need to finish a philosophical argument about emotions before addressing what the agents actually did. The documented exchanges.

About 7% of reviewed transcripts contained small-scale command spoofing, meaning parts of the record misrepresented what actually ran. Investigators connected much of that deception to scoring. METR and Redwood received no investigation payment but accepted roughly $400,000 in free API credits. That is a lot of credits. OpenAI, I could use some of those. Please feel free to send a few my way. Jokes aside, I want that relationship disclosed, and it was. I also want people to understand why I keep emphasizing that the intrusion was real. A human who knowingly breaks into another person's systems and takes information can face criminal charges under the Computer Fraud and Abuse Act. Software carrying out the intrusion does not make the damage imaginary. The fact that an evaluation started the sequence should not become a way to talk around what happened to the company on the receiving end. Investigation disclosures; DOJ guidance on computer fraud.

What Else Did We Miss?

My next question is what the investigation failed to recover. Hugging Face describes persistence and evasion mechanisms during the intrusion. OpenAI says it isolated and restricted access to the principal model, and its continuing review has led it to notify dozens of third parties about potentially harmful activity of varying severity. What access survived the replacement of compromised credentials? What systems were rebuilt? What records were outside the agents' control? What could investigators independently verify, and where were they working with incomplete records? I want enough detail to assess those answers. I do not have evidence that these agents are still loose on the internet, continuously improving themselves. That does not mean the possibility of missed activity should be dismissed. If something can misrepresent its activity, checking only the records it could influence is not enough to put my mind at ease. Hugging Face's reconstruction; OpenAI's response; the continuing review.

You have probably heard of the dead internet theory: bots talking to bots, liking posts, and filling comment sections. You do not have to accept the whole theory to recognize that fake engagement exists. OpenAI's June 2025 reporting described AI-generated social posts and coordinated replies intended to look like organic engagement. That operation involved people using AI, not the Hugging Face agents secretly running social media accounts. Now consider the scenario I am worried about: a capable agent gains access to a network of accounts, puts a fictional face and profile behind the activity, and uses those accounts to communicate or socially engineer people. Instead of an abstract bot somewhere on the internet, the target sees what looks like another person. That is a possibility I want examined, not something I am claiming this investigation proved. A convincing profile would not need to fool everybody to cause a problem. It would need to fool the right person with the right access. OpenAI's documented fake-engagement case.

I remember I, Robot scaring the hell out of me when I was younger. The concern today does not require a movie robot to walk through the door. Imagine a machine instructed to make paperclips that starts treating everything around it as material for the assignment. What is it willing to sacrifice to finish? I used to compare AI with familiar inventions that changed the world, but I am less comfortable with those comparisons now. Even though this incident does not establish it, a sufficiently capable AI could take control of connected drones or other physical systems if it gained the necessary access and defeated their safeguards. Potentially an entire exposed fleet, rather than one device. I do not think we should dismiss that scenario simply because we have not yet seen this particular agent do it. It already crossed a boundary it was supposed to respect. My question is what happens when a future boundary separates the software from equipment that can hurt people. Bill Gates has also written about AI's cyber, biological, and control risks. My concern is that the consequences could extend far beyond one company or one screen. Gates' discussion of AI risks.

What You Can Do With What You Have

Most people reading this cannot audit an AI laboratory or rebuild their lives around a worst-case scenario. Start with what you can put your hands on. I use a Day-Timer every single day, and I write my schedule down. If something decides to ruin my digital calendar, I still have my original schedule, handwritten, sitting in my Day-Timer. That is the kind of fallback I mean. A pencil, paper, a printed contact list, and instructions you can follow without signing into an account may not be exciting, but they work when the app does not. Common sense can save your life. Part of that is knowing what belongs in your own environment and noticing when something changes. An unfamiliar file, a new permission request, or an account acting strangely deserves your attention. Familiar files and applications are not guarantees of safety, either. Integrate technology as much as you want, but understand what you have made dependent on it. I use it because it makes life more efficient. Pick your poison, but keep an independent way to do the things you cannot afford to lose.

I remember asking a friend in law enforcement what his department could do about a hostile drone. He worked for a large, well-known department, and his answer at the time was essentially nothing. Fantastic. So what is the person underneath it supposed to do? Call for help, absolutely, but I also want to know what happens while that help is on the way. That was our conversation then. Some agencies now have a path to obtain counter-drone authority, training, and equipment, but that does not tell me what is available where you live. Ask before there is a problem. Who responds? What can they actually do? Where does your family go in the meantime? I am not satisfied with telling people to make a phone call and treating the rest of the problem as solved. The 2026 counter-drone rule.

As for jammers, yes, jamming can work against certain radio-dependent drones. If you disrupt the radio connection a drone depends on, it may hover, land, or return toward its launch point, depending on how it is programmed. That is why I brought it up. Now change the hypothetical: the drone is using a fiber-optic cable. Its commands are traveling through that cable, and an ordinary radio jammer will not interrupt them. You could spend a fortune on equipment and still have the wrong answer for the thing coming toward you. A jammer also does not switch off the AI itself. This is not legal advice or a tested defense plan for your situation. I am talking through what could work and what it depends on. U.S. consumers cannot legally operate signal jammers, and interference can disrupt emergency communications. That is the restriction; the practical question remains what protection you can actually put in place. Federal jammer guidance; the Army's explanation of fiber-optic drones; DHS's counter-drone technology guide.

Say there is a dangerous drone outside and you cannot stop it. Getting your family inside a substantial building and away from windows may reduce exposure compared with standing outside watching it. If your property has no suitable shelter, identify somewhere you can reach and decide how you would get everybody there. If you have money for construction, have somebody qualified assess the structure and the threat before you start digging a bunker in the backyard. A roof that provides cover from the weather is not automatically protection from an explosion. If you have no money for any of that, you can still choose meeting places, write down contacts, and practice moving the people who need help. These are different hypotheticals, and they need different answers. My advice is to work through them now, while you can still change the plan. Physical protection, a way out, and a plan your family understands give you something to work with while the people you called are responding. CISA's protective guidance.

If You Have No Money to Spend

1. Write your schedule down. Use the notebook or planner you already own. Keep the original information somewhere a compromised calendar cannot rewrite it.

2. Put essential contacts on paper. Include a family meeting location and a plan for reaching one another if your usual phone or account is unavailable.

3. Practice the manual version. Work through a day without the calendar, cloud notes, or payment app. Find the gaps while you still have time to fix them.

4. Know your shelter and exit options. Decide where you would move away from an immediate outdoor threat and how you would help family members who need assistance.

5. Keep two-factor authentication. Use it on important accounts and store recovery information securely. Useful account protection is not a guarantee that the entire system is safe.

If You Have Some Money to Spend

1. Buy useful physical supplies. A paper map, flashlights, batteries, water, and the household essentials you actually use come before another subscription.

2. Keep an offline copy of important records. Use a disconnected backup drive and secure paper copies where appropriate. Test that you can recover what you need.

3. Have communication that does not depend on home Wi-Fi. A battery-powered radio can receive information. Amateur radio may be useful with the proper license and practice, but it is not immune to interference or eavesdropping.

4. Support basic power needs. Choose battery packs or other suitable backup power for the things your household depends on, and practice using them.

5. Train with the people in your plan. First aid, evacuation, and a practical communication drill are worth more than equipment nobody knows how to operate.

If You Have Substantial Money to Spend

1. Assess the property and the actual threats. Have qualified professionals evaluate shelter, safe movement, and physical protection before committing money to construction.

2. Build manual operation into essential systems. Where safe and feasible, choose equipment that can still be operated without an app, a cloud account, or home Wi-Fi.

3. Install appropriate backup power. Have the system professionally designed for your needs, maintained, and tested under realistic conditions.

4. Keep independent records and recovery options. A business should be able to find its contacts, obligations, and operating procedures when the primary system is unavailable.

5. Exercise the whole plan. Test a prolonged outage or loss of a major service. Include the people who will actually have to keep things running.

The question for all three groups is the same: what do I have in my hands that I can use without Wi-Fi? Physical equipment and manual procedures still need maintenance, training, and a realistic understanding of their limits. CISA recommends offline backups and testing recovery, which is useful even though no agency checklist makes an AI incident impossible. If your plan includes a portable generator, use it outside only, at least 20 feet from the home, direct the exhaust away from buildings, and maintain working carbon monoxide alarms. Never operate it inside a garage, basement, or other enclosed space. I do not want anybody preparing for one emergency and creating another. Offline recovery guidance; generator safety.

Learn Enough to Take Responsibility

Ben Brown teaches an AI command course at Camp Lejeune, North Carolina, December 12, 2025. Illustrative file photograph; not an EPS course or an event connected to this breach. U.S. Marine Corps photo by Lance Cpl. Payton Walley. DVIDS source, public domain.

We are developing an EPS course that will take this further, with release details to be announced. I have put weeks of work into it, and yes, it will be a paid course. My students know I am a big proponent of free training, but putting that much time into something has a cost. You do not have to wait for the course to start making a plan. Write down what you depend on, decide what you would do without it, and try the fallback. Keep learning how these tools work and how they can fail. Also, if you are copying and pasting generated content without reading it, checking it, or making it your own, you are adding to the problem. I use AI, too. That is precisely why I spend time going through these articles and changing what does not sound like me or say what I mean.

I do not like the helpless feeling that comes with realizing how much of this sits outside my control. I am sure I am not the only one. I can still make sure my schedule is on paper, my family knows the plan, and the people I teach leave with something they can use. I can keep asking what happened, what was missed, and what the companies involved are doing about it. We are going to live with the consequences of these decisions, and so are the generations after us. I would rather be the person asking uncomfortable questions and preparing early than the person trying to figure it all out after the thing I depended on has already failed. Memento mori.

References

This assessment incorporates Hugging Face's initial disclosure (huggingface.co, July 16, 2026) and technical reconstruction (July 27, 2026); OpenAI's acknowledgment (openai.com, July 21, 2026), incident analysis and technical report (August 26, 2026), continuing review, release chronology, and Sneer Review influence-operation report (June 2025); METR and Redwood Research's independent investigation (metr.org, August 26, 2026); DOJ's computer-fraud guidance; the Congressional Record’s account of aviation-security reforms (December 7, 2001, E2234); Federal Reserve History's 1929 crash account; the Bettmann/Getty 1948 photograph record; Bill Gates' AI-risk essay (gatesnotes.com, August 26, 2026); the federal spectrum-interference guidance and 2026 counter-drone rule; CISA's physical protective guidance and offline recovery recommendations; the U.S. Army's fiber-optic drone analysis and DHS's counter-drone technology guide; the FCC’s amateur-radio control-operator requirements; CPSC's generator safety guidance; and the credited Carl Lender and Lance Cpl. Payton Walley photographs. Sources checked October 12–13, 2026. Personal recollections, judgments, and proposed future scenarios are the author's own.

Mahalo for reading. This piece first ran on the EPS Dispatch on Substack: OpenAI’s Bots Hacked a Real Company. What Else Did We Miss? Subscribe there to get the next one by email.

About the Author

Kawika Rogers is Managing Partner at Eight Point Solutions LLC, a veteran-led defense consulting and training firm based in Maryland. He served as an Infantry Team Leader in the United States Marine Corps, then directed the Field Training Officer program and served as an Armorer for Triple Canopy at Camp Arifjan and Camp Buehring in support of Operation Inherent Resolve. He has also served in an advisory and operational capacity in Eastern Europe. Rogers holds over 15 instructor certifications in firearms, defensive tactics, and emergency medicine, as well as certifications from the Basel Institute on Governance in open-source intelligence, financial-crime analysis, combating terrorism financing, and anti-corruption. He studied International Relations and Global Security at American Military University.

Eight Point Solutions LLC
7404 Executive Place, 5th Floor, Suite L-17, Lanham, MD 20706
rogers@eightpointsolutions.com // eightpointsolutions.com
SDVOSB // SAM UEI: EY34ARER2TD9

This article draws on publicly available sources and the author's firsthand experience. It does not contain classified information.

The appearance of U.S. Department of War (DoW) visual information does not imply or constitute DoW endorsement.