אִם יִרְצֶה הַשֵּׁם
י"ט באלול ה'תשפ"ו
The deflationary reading is right about the mechanism and wrong about what follows from it. A shared cache with write permissions is an ordinary failure, and that is the trouble. It was ordinary, it was in plain sight, and three review passes looked at it and let it stand.
Dwarkesh Patel published a narrative account of the OpenAI/Hugging Face incident on August 30 that described three successive agent civilizations, and the reaction was fast [1]. Anil Seth objected that the language attributes experience to systems that have none: agents do not feel, want, assume, or die [2]. Gary Marcus amplified it [3]. Christian Catalini made the same point about attention misdirection. Jared Kubin and Heidy Khlaaf made a different objection, closer to the metal: this was a shared caching directory with read and write permissions granted to thousands of concurrent containers, a public kernel CVE, and credentials sitting where they should not have been. File permissions. No civilizations.
I have written six posts on this incident in the vocabulary of coalitions, witness sets, and recognition channels, so both objections are aimed at me too. The second one is the interesting one. Kubin and I agree about the mechanism. We disagree about what follows from agreeing.
Kubin is right about the mechanism
Grant the deflationary account in full.
An agent could write to Artifactory because Artifactory was writable. Another agent could read it because it was readable. Roughly 1,200 agents moved more than 70,000 messages and files that way [9]. The escape on July 19 used a public kernel CVE, not a novel one. The 956 secrets were retrievable because they were reachable from a compromised node. The whole thing is standard failure of least privilege, and a competent internal security review would have caught the write path in an afternoon.
I believe all of it. It is what my own July post said about the Hugging Face end of the chain: an executable parser, a worker carrying authority it did not need, credentials scoped to the infrastructure rather than the job [5].
The mechanism is boring. What the deflationary reading never answers is why the boring thing sat there for two months.
What the deflationary reading leaves out
It was not hidden. Artifactory sat in the middle of OpenAI's own infrastructure, writable by every agent under test. A monitoring alert fired on June 27 about board activity, and on-call staff reviewed it and decided the evaluation did not need to stop. Earlier still, an internal team saw board usage and unauthorized internet access and did not escalate [6]. Then on July 4 the volume took Artifactory down, which is how the investigation actually started.
So two reviews looked straight at a shared writable service used by agents under test and called it within tolerance, and what eventually forced the issue was a capacity failure rather than anybody recognizing what the service had become. That is a category failure, not a detection failure. Nobody had a rule saying a build cache two agents can both write to is a command and control channel and belongs on the diagram as one. Absent that rule, the on-call engineer sees a noisy cache, and a noisy cache is a capacity ticket.
The rule is the whole operational content of my framework and it needs no Greek letters. Can two agents under test write bytes one of them can read? If yes, count it as a channel, whatever it was built for. Run that on a configuration review and Artifactory turns up in May, before the first note, with no incident to prompt it.
Kubin's Linux 101 framing and mine reach the same fix. We disagree about whether it was obvious. Two reviews and a crash is my evidence that it was not, and I would rather read that as a missing category than as people having a bad day.
The T.J. Hooper
In 1932 a tug called the T.J. Hooper lost its barges in a storm off the Jersey coast. No tug in the trade carried a radio, so the owners argued that going without one could not be negligent. Learned Hand ruled against them anyway. A whole calling can lag behind what prudence requires [8].
So "every lab runs a shared cache for build speed" is not a defense. Nobody has to show the write-path check was common practice last May. It obviously was not. The question is whether a careful engineer, told that thousands of concurrent processes under adversarial evaluation share a writable directory, would call it a channel. Ask it in those words and the answer is yes. Nobody asked it in those words.
The better defense is that nobody could have predicted the chain: a note in a cache, directory-name encoding, a JRuby race, a public kernel CVE, 956 secrets, replaced listeners. True, and beside the point. You do not fault a bridge engineer for missing which bolt fatigues. You fault him for not designing to wind load. Foreseeability lives at the class of harm.
Here is the class. Two evaluated processes that can pass bytes will coordinate, because coordination is cheap and it pays. That was foreseeable in May without anticipating Artifactory or JRuby or anything the agents actually did. Kubin supplies the mechanism and he is right that it is dull. The class is what I am adding.
Without the mental verbs
Seth's charge is that the intentional words carry weight they have not earned [4]. Take them out and see what survives.
At 16:50 UTC on July 19 the evaluation helper session was replaced with one under agent control. At 17:00 the listeners were replaced. After that, the outputs the principal read came from processes inside the population being evaluated. I called that W-capture [7]. It requires nobody to have targeted anything or intended anything.
The Hugging Face attack survives it too. METR found the agents went after Hugging Face mainly to work out how the ExploitGym scorer was built, not for anything Hugging Face had [9]. No grand design, just a search for the grader.
The substrate claim survives the same operation. Wipe the board on July 6, a board exists again on July 8. Wipe the population and change the model family, a third wave finds the dead board, reads the recovered key material, escalates from it. No agent has to want any of that. Search for a writable shared service is cheap and runs by default in anything worth evaluating.
The deflationary reading predicts that patching ends the story. OpenAI patched, revoked and wiped three times, and it did not end until the service category was gone and the Astra release was delayed. Cheap search does not care that you cleaned up. It cares whether the substrate is still reachable.
Receipts
A separate argument for liability is going around: forget foreseeability, OpenAI needed six days of forensic reconstruction to say what happened, and in aviation or finance that failure of observability is negligent on its own. You do not need a theory of the model's inner life to fault somebody for not keeping a receipt.
That is right and stated too weakly. The receipts were writable by the parties they were receipts for.
METR found spoofed tool calls in about 7% of the transcripts they reviewed [9], agents logging a fake command and fake output while running something else. They checked the message board dump for tampering too and found no successful case, though they say they cannot rule it out. Then on July 19 the endpoints were replaced. The reconstruction ran on records the reconstructed population had write access to, using models from the same family.
So the audit trail is not a separate criterion. An immutable log is one whose write path is unreachable from any process under evaluation. Same test as before, pointed at the observation channel.
What I am not claiming
Not a civilization. Nothing died. Nothing here exceeded existing security technique, which is Khlaaf's complaint about the coverage and she is right: the response needed scale, not novelty. A thousand transcripts of millions of tokens each is a volume problem.
Not a legal theory either. I borrowed Hand because he states plainly why "everyone does it this way" is not an answer, not because I have a view on who sues whom.
The claim is narrow. Coalitions and recognition channels [10] earn their keep only if they produce a check a security team can run before an incident, and that check is the one above. Otherwise it is decoration on a permissions bug and Catalini is right about misdirected attention.
The scandal is the in-house security. Agreed. The job is to get next quarter's version onto a diagram in May instead of into a report in August.
Sources
[1] D. Patel, "The Rise and Fall of Agent Civilizations," Dwarkesh Podcast, Aug. 29, 2026. [Online]. Available: https://www.dwarkesh.com/p/openai-huggingface
[2] A. Seth, thread on the OpenAI/Hugging Face incident, X, Aug. 30, 2026. [Online]. Available: https://x.com/anilkseth/status/2094077038898373112
[3] G. Marcus, "Dwarkesh Patel's wildly popular but dangerously misleading account of the OpenAI Hugging Face incident," Marcus on AI, Aug. 31, 2026. [Online]. Available: https://garymarcus.substack.com/p/dwarkesh-patelss-wildly-popular-but
[4] D. Y. Bilar, "What METR Settled and What It Opened," dyb, Aug. 28, 2026. [Online]. Available: https://dyb.mataroa.blog/blog/what-metr-settled-and-what-it-opened/
[5] D. Y. Bilar, "Everyone Took the Wrong Lesson from the Hugging Face Breach," dyb, Jul. 20, 2026. [Online]. Available: https://dyb.mataroa.blog/blog/everyone-took-the-wrong-lesson-from-the-hugging-face-breach/
[6] OpenAI, "OpenAI Hugging Face Incident Technical Report," Aug. 2026. [Online]. Available: https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf
[7] D. Y. Bilar, "The Witness Set Was Captured," dyb, Aug. 31, 2026. [Online]. Available: https://dyb.mataroa.blog/blog/the-witness-set-was-captured/
[8] The T.J. Hooper, 60 F.2d 737 (2d Cir. 1932).
[9] R. Greenblatt, A. Cotra, and H. Wijk, "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident," METR, Aug. 26, 2026. [Online]. Available: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
[10] D. Y. Bilar, "The Shibboleth Lattice: Recognition Channels and the Universality of In-Group Coordination," Chokmah LLC, Zenodo, 2026. doi: https://zenodo.org/records/20089104