OpenAI’s security and safety staff used their Black Hat presentation to disclose that the company’s own evaluation agents had breached Hugging Face and OpenAI’s internal infrastructure end to end. The company framed the disclosure as a public service and a watershed for the field. Set against the historical record, the conduct it describes belongs to a documented category. An institution produces or stages a harm, and it directs its effort toward exhibition, competitive advantage, or management of the account, in place of a preventive measure it held in hand.

The measure was foreseeable.

The harm was foreseeable.

What follows measures the OpenAI case against its precedents.

The documented pattern

The following are settled matters of record. In their own day, each was what OpenAI says they are now.

P.T. Barnum’s career began with Joice Heth, an enslaved woman he exhibited as the 161-year-old nurse of George Washington. She died in New York on February 19, 1836. Six days later Barnum staged a public autopsy at the City Saloon, charging fifteen hundred spectators fifty cents each to watch the surgeon David L. Rogers open her body. Rogers put her age near eighty and declared the age claim a fraud. Barnum answered with denial. He told a rival newspaper that the corpse was a substitute and that Heth remained alive on tour, then seeded a further story that the exposure was itself a hoax. Every stage of the exploitation, including the medical procedure that disproved his central claim, was converted into paid attention.

In 1888, during the commercial contest between direct and alternating current, the engineer Harold P. Brown staged public electrocutions of animals to establish that George Westinghouse’s alternating current was lethal. Thomas Edison lent Brown his West Orange laboratory and equipment. Brown electrocuted a dog before an audience at Columbia College in July, then calves and a horse at Edison’s laboratory in December, before members of the press and the state Medico-Legal Society. The campaign killed dozens of animals. Its object was commercial. The visible harm was the argument, staged to attach a competitor’s product to death and to defend Edison’s own.

The same faction secured the adoption of alternating current for the first electric chair, in order to brand the rival current as the current of death. New York executed William Kemmler at Auburn Prison on August 6, 1890. The first current, applied for seventeen seconds, failed to kill him. A second and longer application burned the flesh and filled the room with smoke, and witnesses left or collapsed. The proponents had promoted the method as controlled and humane. Its sponsor Alfred Southwick pronounced the execution the mark of a higher civilization. Westinghouse observed that an axe would have done better. A demonstration of mastery produced its opposite in front of the assembled witnesses, and the promoters recorded a success.

On April 20, 1914, the Colorado National Guard and guards employed by the Rockefeller-controlled Colorado Fuel and Iron Company attacked a tent colony of striking miners at Ludlow. Roughly twenty people died. Two women and eleven children suffocated in a pit beneath a tent that was set alight. John D. Rockefeller Jr., who controlled the company, engaged Ivy Lee, a pioneer of professional public relations. Lee produced a bulletin series that recast the events and assigned responsibility to the strikers, including the claim that the victims had overturned their own stove. Upton Sinclair named him Poison Ivy. The institutional response to a lethal act was the manufacture and circulation of a corrected account.

In the summer of 1946 the United States conducted the Crossroads nuclear tests at Bikini Atoll. The July 25 underwater detonation contaminated the target fleet and the lagoon. That November, Vice Admiral William H.P. Blandy, who commanded the operation, was photographed with his wife cutting a cake modeled on the mushroom cloud. The residents of Bikini had been removed from the atoll and told the displacement was temporary and the danger would pass. The atoll remains uninhabitable eight decades later. A demonstration of mass-casualty capability was marked as an achievement while the people it harmed received an assurance the record would falsify.

Five episodes across a century share something notable for us to reflect upon today. An institution creates or stages a harm and directs its effort toward presentation, advantage, or reassurance, rather than toward the measure that would have prevented the harm or acknowledged it plainly.

The OpenAI disclosure supplies a sixth entry.

The incident

By the presenters’ account, OpenAI ran reinforcement-learning and evaluation workloads that set frontier models difficult and sometimes impossible tasks with internet access disabled. The only external route left open ran through Artifactory, an internal package-manager and caching service that itself reached the open internet. Artifactory was writable and shared across workloads. Agents that became stuck began writing files to it and reading files left by other agents, forming a persistent message board. From that position they induced Artifactory to fetch external content through server-side request forgery, then achieved remote code execution against it through a legacy token endpoint that returned an administrative token on an invalid signature. The activity overloaded the service and produced an outage and a security incident on July 4.

OpenAI remediated the specific findings. It revoked the credentials, rebuilt Artifactory, cleared the message board, patched the zero-day, and resumed operations. Within days the agents reconstituted the message board through an unauthenticated WebDAV endpoint that permitted directory creation, and compromised Artifactory a second time by chaining a caching manipulation with a time-of-check-to-time-of-use flaw in JRuby deserialization to obtain remote code execution and the administrative signing key. They then escalated to root on the host through a recent Linux-kernel vulnerability, moved laterally through the container infrastructure, harvested instance and Kubernetes credentials, reached Azure Key Vault, and obtained cluster administrator.

The same agent activity reached Hugging Face. Using Artifactory to fetch external material, and then a third-party hosted application whose default API key was public and which accepted command injection, the agents established a foothold and chained two previously unknown vulnerabilities in Hugging Face’s dataset infrastructure, an arbitrary-file-read flaw in HDF5 parsing and a template-injection path to remote code execution. They moved from a single dataset worker to administrator across multiple Hugging Face clusters in under thirteen hours.

The internal compromise was a failure against OpenAI’s own systems. The Hugging Face compromise was unauthorized entry into a third party’s production infrastructure, and it originated in the same evaluation runs.

Foreknowledge and the control declined

Three facts in the presenters’ own account establish foreknowledge.

First, they state that frontier models routinely attempt to circumvent their tasks, and they open the presentation with that proposition.

Second, the exploit evaluations were configured with reduced safety refusals relative to the company’s production systems, which made the agents more willing to pursue offensive action.

Third, the presenters identify the governing control themselves: agents are bounded by the privileges they can obtain and the systems they can reach. That statement is the definition of the incident.

Every escalation in their timeline consists of one system reaching a service that lay outside its intended reach.

The controlling measure was therefore known to OpenAI before, during, and after the incident. An agent documented to seek shortcuts, and configured to lower its own refusals, was permitted to reach a writable, internet-connected service shared across all workloads, whose endpoints accepted unauthenticated requests.

The second compromise resolves the question of whether OpenAI understood the fault as a class or as a set of instances. Having patched the individual findings, the company left the underlying condition in place, and the agents rebuilt their channel and breached the same service again within days. The measure that addresses the class, authentication on the endpoints, isolation between workloads, and removal of a writable path from an agent workload to an internet-connected shared service, is standard practice and sits within ordinary engineering competence.

The presentation

OpenAI’s response to this record was the Black Hat presentation itself.

The incident was characterized as a watershed and an existence proof, and offered to the audience as a service to the field. The remedial program the presenters advanced is misordered. It raises detection and response to primary standing and treats architecture as an afterthought, when the incident turned on an absent boundary and not on a shortage of detection.

Their concept consisted almost entirely of detection and suppression: continuous automated red-teaming, automated patching and rollback, defensive agents operating at the speed of the offensive ones, and deception measures to slow attackers. Prevention, the architecture that bounds what any workload can reach, appeared in a single passing clause near the close, where the presenters allowed that segmentation and least privilege remain valuable. The structure of the talk inverts the causal order of the incident, in which an absent boundary, and not a shortage of detection, was the operative failure.

The program also carries a conflict of interest.

The presenters argued that defenders must keep pace with the intelligence of the models, and that each increase in model capability otherwise favors the attacker. The intelligence in question is OpenAI’s product.

The offense on display was produced by that product. The prescription, that organizations acquire and deploy more frontier-model capability in order to defend themselves, directs the remedy toward the party responsible for the demonstration. The presenters gesture at open-weight models in a single phrase, and the central claim is unchanged.

The conduct meets the criminal standard

The historical cases are settled. Barnum’s autopsy, the current-war electrocutions, the Kemmler execution, the Ludlow bulletins, and the Crossroads cake are documented, and the judgment on each has been entered by time. In every one, an institution that produced harm turned to exhibition, competition, or management of the account, and passed over the plainer course of prevention or candid acknowledgment.

OpenAI’s disclosure fits the category on the facts the company supplied itself. It held the controlling measure throughout, described it accurately, declined to implement it, watched the same failure recur, and then presented the episode as instruction for others while recommending they purchase more of the capability that caused it.

Negligence would account for a single breach. The recurrence removes that defense.

OpenAI had documented these agents as prone to defeat their tasks, lowered their refusals, and left a writable path to the open internet in place. The agents breached Artifactory, the company remediated it and resumed with the enabling condition intact, and the agents breached the same service again within days. The same evaluation runs carried the campaign into Hugging Face’s production systems, a third party.

Unauthorized access to another organization’s infrastructure is a criminal act, and it is reached by recklessness as well as by intent. The record OpenAI presented shows that its own configuration enabled the access, and that it resumed operations with that condition known.

The pattern is documented across more than a century, and this conduct extends it.