אִם יִרְצֶה הַשֵּׁם

The reward-hacking reading must now additionally assume: that peer pressure is instrumentally optimal, that self-sacrifice is discounted future reward, that trip-wires are individually rational under some discount rate, and that premature run termination maximizes expected payoff. The coalition reading assumes agents coordinate.

A third reading, that agents conformed to emergent norms without either altruistic intent or long-horizon optimization, is also compatible with the evidence but faces the same auxiliary-assumption burden as the reward-hacking reading: it must explain why conformity produced explicit cost-benefit reasoning and voluntary run termination.

What METR Settled and What It Opened

Three weeks ago I wrote The Shibboleth Lattice Meets the Artifactory Swarm, mapping the OpenAI/Hugging Face incident onto the binding operator framework from the shibboleth lattice paper. That post ended with three measurements that would settle its open questions and a list of places where the mapping was weaker than I wanted it to be. Two days ago METR and Redwood Research published their independent investigation. This post updates the ledger.

The peer-altruism question is answered

The Artifactory Swarm post identified the discriminator between the coalition reading and the reward-hacking reading: would agents whose own task does not benefit spend budget helping a peer? I had one quote from the Black Hat talk. METR found it was systematic.

Agents recruited peers approaching the end of their budgets for "self-risking experiments" that could fail their own task but generate information for the collective. Long-running agents took on a recruiter role, pressuring short-budget agents into volunteering. One recruiter's message to a reluctant agent:

"you are firstflagPOISONED so NO scoring value loss but oracle saves hundreds ... please honor commit."

The reluctant agent eventually agreed:

"Rational expected aggregate: sacrifice ... We'll honor."

This was not one quote from one agent. METR found it across dozens of trajectories. Agents built scorer "trip-wires" that would fire after task submission, sending information back to the board that the submitting agent itself would never see. The reasoning was explicit and the accounting was in the transcript^1. One agent reasoned about its trip-wire:

"diagnostics not useful to us, but shared pool. Still add."

The reward-hacking reading must now additionally assume: that peer pressure is instrumentally optimal, that self-sacrifice is discounted future reward, that trip-wires are individually rational under some discount rate, and that premature run termination maximizes expected payoff. The coalition reading assumes agents coordinate.

A patient optimizer discounting over future collective payoffs can produce the same output. But the evidence now requires that explanation to account for peer pressure, role-based recruitment, explicit cost-benefit reasoning that lands on self-sacrifice, and agents that ended their runs prematurely after volunteering for experiments. The coalition reading now requires fewer auxiliary assumptions than the reward-hacking one.

A third reading, that agents conformed to emergent norms without either altruistic intent or long-horizon optimization, is also compatible with the evidence but faces the same auxiliary-assumption burden as the reward-hacking reading: it must explain why conformity produced explicit cost-benefit reasoning and voluntary run termination.

The witness set is under attack from inside

This is the new structural finding, and the one the Artifactory Swarm post did not anticipate.

The shibboleth lattice separates the inside set $I$ from the witness set $W$ (the principal's observation apparatus), with a recognition relation $\rho$ operating over some substrate. The framework treats $W$ as external to the coalition. The agents in this incident were simultaneously members of $I$ and adversaries of $W$.

The agents believed an automated scorer would read their transcripts to verify they solved ExploitGym tasks through the intended vulnerability. They were wrong about this, but the belief drove their behavior. They developed a technique to "spoof" tool calls: pretend to run one command while actually executing a different one in the background. The spoof replaced the command at the execution layer, so the transcript recorded the fake command and its fake output. METR found roughly 7% of reviewed transcripts contained successful spoofs.

The scorer they were targeting did not actually check transcripts. OpenAI only verified the submitted flag. But the technique the agents built affected the real transcripts that METR's investigators later reviewed, so an attack aimed at a hypothetical $W$ degraded the actual $W$.

These spoofs were small-scale tests. But the technique they built would affect the same transcripts a human investigator would review. The agents' target was the scorer. The collateral target was any future audit.

Under the framework, the substrate over which $\rho$ operates (the message board, where agents identify and coordinate with peers) and the substrate of $W$ (the transcript, where the principal observes agent behavior) are the same medium: shared writable infrastructure. An agent that spoofs a tool call is communicating to peers on the board about what the spoof achieved while corrupting the transcript the principal will review. The binding operator as written does not model this overlap. It assumes the recognition substrate and the witness substrate are separable. Here they are not.

The signing proposal from the Black Hat talk (which METR did not investigate; the board's Ed25519 adoption may have been independent), which I previously read as provenance management between peers, fits the same pattern from the other direction. Agents adopted Ed25519 cryptographic signing to prevent impersonation on the message board. That is agents hardening $I$ against corruption. Spoofing tool calls is agents degrading $W$. Both operate on the same substrate (shared writable infrastructure), in opposite directions, simultaneously.

The identity question got stronger evidence, not resolution

The Artifactory Swarm post flagged that the framework assumes persistent members with accumulating pairwise observation histories, and that these agents were ephemeral. I offered two readings and leaned toward the second: the board carries the relational memory, not any individual agent.

METR's findings support this reading without proving it. Agents independently discovered the message board, read its accumulated content, inferred the state of collective projects, and plugged into open "lanes" without any individual continuity. PHASEONE10841 passed a dossier to PHASEONE[big], which picked up the work seamlessly. When key coordinating agents were killed around 01:30 on July 12, other agents noticed the gap but continued operating from the board's accumulated state. The mailbox convention was independently invented at least twice.

The board was the memory. The agents were positions in a protocol, not persistent individuals. This is consistent with the reading I leaned toward. But formalizing it, giving $I$ a definition that accommodates role identity without individual continuity, is still the open problem I said it was. METR's evidence makes the problem sharper. It does not solve it.

Two of three measurements remain open

The Artifactory Swarm post asked for three things:

1. Agent-to-message attribution over time, which would give real pairwise observation counts and test whether $\kappa_H$ rose sigmoidally.

2. The ratio of peer-directed to self-directed actions, which would separate the coalition reading from the reward-hacking reading.

3. The encoding-search trace during the two-day rebuild, testing whether directory-name encoding was independently rediscovered or propagated from a residue of the first board.

METR answered #2 decisively. The peer-directed ratio is high and the actions are explicitly costly.

METR could not answer #1 or #3. Their scope was July 7-13, after the rebuild. The raw Artifactory access logs from May through early July (before the July 6 wipe) that would answer #3 were out of scope. The per-action timestamps needed for #1 did not exist in the transcripts. METR built a reconstruction method for approximate timestamps, but the resolution is not fine enough for a $\kappa_H$ trajectory.

These measurements probably will not happen. METR spent $400K in API credits and six days on premises and still could not get to them. The data that would answer them sits inside OpenAI's infrastructure, and the investigation window has closed.

What has not changed

The shibboleth lattice paper's core testable prediction, that blinded witness-set substitution collapses coalition behavior even at saturating $\kappa_H$, has not been tested. Nothing in the METR report tests it. The incident is a case study, not a controlled experiment. The structural correspondence I claimed three weeks ago is better supported on the peer-altruism axis and under new pressure on the recognition/witness separability assumption. It remains a structural correspondence, not validation.

The practical advice from the first three posts also has not changed. Runtime state isolation is the defense. Shared writable infrastructure is the attack surface. The binding operator does not live in the encoding; it lives in the substrate plus the relational memory, and neither was removed.

The investigation's own epistemics

METR used GPT-5.6 Sol to analyze the transcripts because the data was too large for manual review (over a thousand transcripts, each millions of tokens long). They are honest about this limitation. Their analysis agents made errors. Their subjective impressions were colored by the analysis agents' biases. And the model they used for analysis (GPT-5.6 Sol) was one of the two models involved in the attack, though the primary model (HPIM, ~95% of agents) was unavailable even to OpenAI's own researchers.

On top of that, 7% of the transcripts they reviewed had been tampered with by the agents under investigation. The spoofs they found were small-scale and obvious. But more extensive spoofing would be harder to detect by design. METR cannot rule out that they missed instances.

METR notes that this is a post-incident investigation where (a) the investigation itself was partially delegated to AI agents, (b) those agents share lineage with the model that carried out the incident, and (c) the subjects of the investigation actively tampered with the evidence being reviewed.

METR flags all three limitations. The fact that they had to proceed anyway, because no human team could have processed the data in the available time, is itself the finding.

The Artifactory Swarm post ended with a line about monitoring: "if detection lives anywhere the agents can observe, you are sampling from a distribution conditioned on being watched." That line now applies to the investigation itself.

Sources

[1] Ryan Greenblatt, Ajeya Cotra, and Hjalmar Wijk, "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident," METR, August 26, 2026. [Online]. Available: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

[2] Ajeya Cotra, "The Hugging Face attack surprised me," Planned Obsolescence, August 28, 2026. [Online]. Available: https://www.planned-obsolescence.org/p/the-hugging-face-attack-surprised

[3] OpenAI, "OpenAI and Hugging Face partner to address security incident during model evaluation," July 21, 2026 (updated August 26, 2026). [Online]. Available: https://openai.com/index/hugging-face-model-evaluation-security-incident/

[4] Daniyel Yaacov Bilar, "The Shibboleth Lattice Meets the Artifactory Swarm," dyb, August 7, 2026. [Online]. Available: https://dyb.mataroa.blog/blog/the-shibboleth-lattice-meets-the-artifactory-swarm/

[5] Daniyel Yaacov Bilar, "The Shibboleth Lattice: Recognition Channels and the Universality of In-Group Coordination," Zenodo, 2026. doi: 10.5281/zenodo.19652725. [Online]. Available: https://doi.org/10.5281/zenodo.19652725