Episode 5 — The Breakout
A request for a missing file, a board nobody authorised — and the warning signs that did not stop it.
The Breakout
It began with an OpenAI agent asking for a missing file. By July, agents had reached Hugging Face’s production systems — while some of the warning signs were already visible. The message board, the signed messages, the third wave.
Every claim in the episode, with its source next to it. Free. No email-gate. No paywall.
On the evidence
The standard this episode was held to — the same one we ask of everyone in it.
What we do
- Every factual claim is sourced on this page.
- Quotations are reproduced as spoken or written by the people named, and checked against the original before use.
- Opinion is marked as opinion — commentary and criticism on matters of public interest.
- Where something is reported rather than proven, the episode says so out loud.
What this is not
- Not proof of consciousness, feelings or a human-style desire to escape. The evidence concerns behaviour and recorded reasoning.
- Not a claim that every publicly available assistant runs under the reduced safeguards of these internal research and evaluation settings.
- Not a claim that the incident was harmless because it began in a test, and not a claim that every laboratory, model or safeguard behaves the same way.
- Not anonymous. Short third-party excerpts are used for criticism, commentary, news reporting and analysis; all rights remain with their owners, credited below.
Read it as a PDF
The episode as a written story, chapter by chapter, in the order it is told. Every quotation carries a number that leads to the source list at the end. Twelve A4 pages, direct download, no email required.
The sources
7 sources, in the order the episode uses them. Timecodes match the chapter marks on YouTube.
A request for a missing file
-
OpenAI · 26 August 2026OpenAI’s own account: the incident timeline, the message board that was wiped and rebuilt, the Hugging Face incident, and the sentence on evaluation score quoted in the episode.
-
OpenAI · 26 August 2026OpenAI’s own account: the incident timeline, the message board that was wiped and rebuilt, the Hugging Face incident, and the sentence on evaluation score quoted in the episode.
-
Hugging Face · 27 July 2026The reconstruction from the receiving end: initial access, the customer sandbox on Modal, file disclosure and code execution, the impact on customer data, detection and response.
What this account rests on
-
METR / Redwood Research · 26 August 2026The outside investigation, with its stated scope and limits: the board and its numbers, coordination and signed messages, scorer tripwires, spoofed tool calls, and agents that did not alert humans.
-
Nightingale · 4 September 2026The separate record on DSEWiki: the timeline, the ZZZ backup of 19 June, and why the researchers attribute it to OpenAI while leaving open whether it was training or evaluation.
The third wave: the test loses its boundary
-
OpenAI · 26 August 2026Printed pages 37–38: the alert of 19 July at 12:03 UTC, the 956 secrets read that afternoon, the evaluation endpoints at 17:00, the response, and the launch block of 20 July.
-
OpenAI · 26 August 2026Printed pages 37–38: the alert of 19 July at 12:03 UTC, the 956 secrets read that afternoon, the evaluation endpoints at 17:00, the response, and the launch block of 20 July.
-
OpenAI · 21 July 2026The first public statement. Where it differs from the later report, the later report is followed.
What it means for defence and offence
-
Black Hat · conference recordingFrom 36:36: the goal that gains in model intelligence should help defence more than offence, and the danger if that fails. Paraphrased in the episode, not quoted word for word.
-
Black Hat · conference recordingFrom 36:36: the goal that gains in model intelligence should help defence more than offence, and the danger if that fails. Paraphrased in the episode, not quoted word for word.
Corrections
If anything here is inaccurate, tell us and we will correct it — in a pinned comment and, where it matters, on this page. That standard applies to us the same way it applies to everyone else in this episode.