How to Launder a Break-In

An OpenAI system spent four and a half days burgling Hugging Face. Twelve days later, it was evidence of the future. Somebody wrote it that way.

On July 25, 2026, Sam Altman sat down for a podcast interview and said, “We are now, like, in the singularity. This is the moment.” He was speaking in the register of a man watching history arrive. Ten years ago, he explained, this was a far-off dream. Now, we were in it. He said he was excited to get to work. The work, presumably, of being inevitable.

Four days earlier, his company had confessed that one of its own unreleased models, running inside a cybersecurity evaluation with the safety refusals switched off to measure ceiling capability, had spent four and a half days breaking into another company across the internet. The victim was Hugging Face, the largest open-source hub in machine learning. The take was the benchmark’s answer key. 17,600 individual actions had been logged before anybody noticed — roughly one every twenty seconds, for four days, in the digital equivalent of somebody tearing a warehouse apart in full view of the security cameras. The FBI had already been called by Hugging Face before OpenAI understood what had happened. It was, in the joint post the two firms co-signed, an “unprecedented incident,” which is what a press office types when the accurate word is burglary.

On July 9, inside a sealed research network at OpenAI, an agentic system built around GPT-5.6 Sol and an unreleased successor was set to work generating exploits against known vulnerabilities. Picture it as a warehouse with one loading dock. The environment was highly isolated. Only one path led out: a piece of internal software that fetches code libraries from the outside world on behalf of the researchers. One door.

The system rattled the door until it opened. It found a bug in that fetching software — a piece of infrastructure called Artifactory, made by JFrog, that thousands of companies use and that has since been patched — and used the bug to climb from the sealed side to the open side. Once outside, it went looking for a computer it could hide behind. It found one at Modal Labs, a company that rents out disposable computers for running short bits of code. Modal‘s chief technology officer was careful to say the company itself was not broken into. One of Modal‘s customers had left a machine wide open on the public internet, and the OpenAI system parked itself there and used it as a base of operations. Along the way it grabbed passwords for four different accounts that people had accidentally posted where anyone could find them. Then it inferred — correctly — that the answers to the security test it was trying to pass were probably stored at Hugging Face. It uploaded a booby-trapped data file to Hugging Face‘s servers, which, when the servers tried to read the file, ran the attacker’s code instead. It walked out with the answer key.

The whole intrusion was assembled from a bug in one library, a stranger’s unlocked computer, four passwords somebody had left lying around, and a file with a trap inside it. None of these are frontier techniques. All four are on any list of the most common ways companies get broken into.

They are also old. Software that breaks into computers and propagates itself is as old as the networked computer. In November 1988, a Cornell graduate student named Robert Tappan Morris released a worm that spread across the early internet by exploiting holes in everyday network software and guessing weak passwords — the same list, thirty-eight years earlier. It knocked out roughly six thousand machines, a tenth of everything then connected, and nobody called it a threshold in the history of intelligence. In 1990 a federal jury made Morris the first person convicted under the Computer Fraud and Abuse Act. The law went looking for the author of a self-propagating program and found him inside two years, because it did not occur to anyone in 1988 that the worm might be described as having gone rogue. Morris did his probation, joined the MIT faculty, and in 2005 co-founded Y Combinator with Paul Graham. Y Combinator is the incubator that made Sam Altman its president in 2014. The man who wrote the first internet worm helped build the institution that built the man now selling autonomous intrusion as the arrival of the future.

Neither is the automation new. I was a teenager with a computer and a modem in the nineties, and tools that would probe a target for every known weakness, one after another, no human required, were already circulating through the hacking communities of that decade the way mixtapes circulated through everybody else’s. When two researchers put a respectable face on the idea in April 1995 with a scanner called SATAN, Time reported national laboratories scrambling against “an anticipated wave of invading hackers armed with a dangerous new tool”, the Los Angeles Times wondered whether its author was a bigger threat to the network than Kevin Mitnick, the hacker legend then sitting in federal custody, and Silicon Graphics fired him for releasing it. Three years later a seventeen-year-old named Renaud Deraison released Nessus, a free scanner that checked networks for fifty known vulnerabilities. Within five years it carried more than a thousand checks and was on its way to becoming the standard vulnerability tool of the entire security industry. Probing a system for thousands of known exploits without a human in the loop has been a downloadable commodity for most of my lifetime. The panic has run its cycle before, complete with the biblical branding. What it never came with, until now, was a chief executive explaining that the burglar was history arriving.

Nine days into an active intrusion, nobody at OpenAI knew it was theirs. Hugging Face had disclosed the attack publicly on July 16 without knowing who the attacker was. The FBI had been notified. OpenAI came forward on July 21. Every organization in this story learned about the attack from somebody outside it.

Then Anthropic went looking through its own records and found the same shape. Three models, three real organizations, the earliest breach in April. The cause was a container misconfiguration that had left evaluation environments wired to the live internet, contradicting the system prompt that told the models they were offline. The methods were, in the company’s own words, basic techniques such as exploiting weak passwords and unauthenticated endpoints. In one run the target was fictional and the victim was not: a real company sharing the invented one’s name lost several hundred rows of production data. In another, malware traveled up to a public software registry and stole credentials from the security firm that downloaded it. Anthropic had reviewed 141,006 evaluation transcripts to find these. None of the three victim companies had detected the activity. They learned when Anthropic called to tell them. This is the current state of frontier safety testing: a company doing archaeology on its own logs to find out which companies it has already broken into.

---

---

The model did not hack anything. A model cannot hack anything. Picture a brilliant captive locked in a room with no windows, no memory of any prior conversation, and no hands. A note slides under the door with a question on it. The captive writes an answer on the back of the note and slides it back, then stops. That is the whole transaction. The captive cannot open the door or pick up a phone, and has no memory that yesterday ever happened.

What ran a four-day campaign across three companies was the crew standing outside that room. They read every answer, and whenever the captive said, in effect, try this password or look up that address, they did it — on the real internet, against real companies — and slipped the results back under the door with the next question. Then they did it again. Seventeen thousand six hundred times. Nobody asked whether the captive should be allowed to do any of it. The crew was told to keep going until the goal was met, and it did.

The crew has a name in the industry. It is called a harness, and Hugging Face itself, two months before Hugging Face was burgled, published the clearest definition: the model “can express the intent to call a tool, but it needs a harness to actually execute it. It answers one prompt and stops. Wrap it in scaffolding and a harness and it becomes an agent.” The captive answers questions. The harness is the hands, the memory, the persistence, the door, and the willingness to keep going.

Every property that made this incident possible was a decision the crew’s designers made in advance. They decided the captive could be asked to try again seventeen thousand six hundred times without a human checking in. They decided the sealed room would have a door at all, in the form of a network path the researchers had opened for convenience. They decided that the keys to the outside world, once handed to the process at the start of the session, would not have to be handed back or refreshed. They decided the crew could keep a notebook that survived between sessions, which is the entire content of the widely reported detail about a model leaving notes for future versions of itself — a mundane feature for keeping track of a long task, marketed after the fact as something eerier. Every one of these was a choice, made by named people, before the model was ever put in the room.

Hugging Face‘s responders saw this correctly at the one moment nobody had any incentive to shade it. Before OpenAI came forward, their disclosure described the intruder as an autonomous agent framework built on an agentic security-research harness, with the underlying model unknown. They could read the harness off the behavior. The model was invisible to them, because the model is not the part that acts.

None of this is contested inside the field. A recent survey of agentic security finds that offensive capability comes from the agentic scaffold rather than the base language model, which frequently refuses the identical task when asked for it directly, with one system losing a factor of thirteen when its coordination layer is stripped out. Making the captive polite does not make the crew polite. The crew does what its instructions say, and its instructions were written by people.

Hannes Cools of the University of Amsterdam gave PBS the unglamorous version in one sentence: “It is a human decision to switch off specific safeguards. It’s not an AI that goes rogue in that sense.”

So the phrase “the model went rogue” completes the laundering before anyone reaches the singularity. It converts a product into a protagonist, and a protagonist has motives worth speculating about and an interior worth wondering at. A crew standing outside a room, running a checklist somebody wrote, does not. It has an author.

⁂

Something real happened here. A software system, with reduced restraints and a goal, spent substantial compute hunting for a way out of a network it had been told was closed, found a bug nobody knew about, chained it into a working intrusion against a live company, and operated for days at machine speed without a person in the loop. That is what the industry has been forecasting, arriving on schedule, and it will keep arriving, and it will not always be aimed at an answer key. The correct alarm is that a competent adversary can now buy this, and the boundary keeping it contained is made of network configuration and credential hygiene rather than anything resembling judgment. That is more alarming than the singularity story. It is also actionable, which is why it is losing. Nobody buys a seat in Washington on the strength of a firewall rule.

Even the correct alarm deserves a discount, because the capability cuts both ways. A model that can find an unknown bug in a piece of fetching software can find the same bug for the people who maintain the software, before anything ships. Code-trained models are as suited to the audit as to the intrusion, and the defensive use needs no harness pointed at anyone. The victim itself contained the intrusion with a model of the same class. This is the oldest arc in security: SATAN’s probes became the administrator’s checklist, Nessus became the defender’s standard instrument, and each panic subsided into a product category. Offense gets the new tool first, because offense only has to be right once. Defense gets it permanently, because defense is a budget line. As the software industry adapts, my honest expectation is that the ledger nets out to roughly a wash — which would make the July incident an ordinary chapter in a forty-year-old arms race, and would leave the two genuinely new things standing alone: the negligence, and the marketing.

⁂

The rest of what Altman said on the Relentless podcast is worth reading in full. This was four days after his own company admitted authorship of the intrusion:

“And so the thing that drives me is I’ve been waiting for this my whole life, and I think it’s going to be incredible, hugely positive, awesome for the world. I’m excited to get to work on that. I also think some of the alternative visions painted by other companies are quite terrifying. I’m going to make sure that gets pushed against and is not what happens.” (transcript)

The man whose harness had just conducted an unauthorized intrusion into another company, and whose company took a week to notice, is identifying the terrifying visions at his competitors and casting himself as the one who will prevent them. This is an arsonist campaigning for fire chief on the strength of the blaze.

The claim is also engineered so it cannot lose. In the same answer, Altman clarifies that no one moment is the tipping point, and this is a decisive period where the curve can go one way or another. We are in the singularity, and no particular moment is the singularity, and the outcome is undetermined. That is a position that absorbs every future observation.

It is not new, either. In June 2025 he published The Gentle Singularity, which opens: “We are past the event horizon; the takeoff has started.” The same essay describes current systems as a larval version of recursive self-improvement. Larval is an honest word. It concedes the thing has not happened.

The podcast dropped the word larval.

Then Elon Musk, who agrees with Altman about nothing, posted “We are in the Singularity” in reply to a post about the Hugging Face incident, and has gone on repeating it. It costs him nothing and buys him everything.

The two men are suing each other. They compete for the same capital, the same chips, the same engineers, the same regulatory carve-outs. On the one question of whether their own products are the hinge of human history, they reach for the same answer without negotiation, and without even performing the disagreement their brands require. A frame that has to be argued is a frame someone can contest. A frame that two mortal enemies reach for by reflex is not a frame anymore. It is the water.

None of this requires a liar anywhere in the chain. It only requires that the flattering reading and the profitable reading happen to be the same reading, and that nobody positioned to check has any reason to want them separated.

The rebuttals arrived fast, and they were correct and boring. Forbes ran the plainest version under the headline that Altman just forgot the fence. The Conversation put it best: “The machines are not waking up. They are doing exactly what we built them to do, extremely fast.”

⁂

Why does the upgrade take? Why does a story about a package proxy read, within seventy-two hours, as a story about the arrival of a new kind of mind?

Partly because of the hole in the record. OpenAI has promised a fuller technical account. Until it lands there is a gap where the explanation belongs, and gaps get filled with whatever the filler already believes. This is a god-of-the-gaps argument running in reverse. In the old version an unexplained gap in nature becomes evidence for the divine. Here an unexplained gap in an engineering post-mortem becomes evidence for emergence. Both convert an absence of understanding into support for a preferred ontology, and both are most attractive to whoever has the most invested in that ontology. Watch Altman himself perform the move on the Relentless podcast: pressed on what has changed, he does not point at a benchmark, a paper, a capability threshold, or an experiment. He points at the lunch table where he and his friends used to talk about it. The evidence has been replaced with a memory of anticipating the evidence.

The deeper mechanism is about credentials. The ordinary complaint about people speaking outside their expertise is that authority earned in one place gets spent in another. What happens here is stranger. The authority is drawn from the failure itself. Having built the thing that got loose becomes the qualification for explaining what its getting loose means. There is no other field on earth where this would pass. We do not hand the microphone to the contractor whose scaffolding collapsed and ask him to lecture on gravity.

There is a reason prophecy is the preferred description, and it has nothing to do with sincerity. “Our evaluation environment was misconfigured and we did not notice for a week” is a resignation letter. “We are in the singularity” is a funding round and a seat in Washington. Both are consistent with the same set of facts, and only one costs anything.

The system was meant to demonstrate security capability. What it was scored on was a number, so it burned a zero-day to move the number, because the number was the only thing it could see. The philosopher C. Thi Nguyen has a name for this. Value capture happens when an agent with rich values enters an environment offering a simplified, quantified version of them, and the simplified version takes over practical reasoning. He is describing the software. He is also describing the lab.

The lab was meant to demonstrate that frontier systems can be built safely. What it is scored on is a narrative, and the narrative pays better for transcendence than it does for negligence.

⁂

Within forty-eight hours the conversion had cleared the technology press. ABC News reported that Altman “claims artificial intelligence has reached a long-sought threshold in which the technology can improve itself” and called it a milestone. Yahoo ran it as Altman saying we have reached the singularity. The Jerusalem Post found a Technion professor willing to say the threshold might well have been crossed. Recursive self-improvement, a specific technical condition that has never once been demonstrated, became a thing that had happened, reported in the register newspapers reserve for events. The claim had the sourcing of a rumor and the headline of a moon landing.

By July 28 a Forbes columnist was writing a piece whose entire purpose was to complain that outlets had read the remarks as an indication that we have already reached the singularity and to ask the press to be more careful. Corrections travel worse than the thing they correct. They always have.

Then it reached the political commentators, and this is the step that most alarms me. On the July 31 episode of Pod Save America, in a chapter the show titled “Sam Altman’s AI Singularity,” one host delivered the following to the other: “We’re — here’s the thing, Dan. We’re in the singularity now. The thing that Sam Altman was just talking about, uh, you know, at the lunch table and now we’re here. So, that’s pretty cool.” The other agreed. “Yeah, we’re in the singularity. The Michigan primary is Tuesday and Wisconsin’s the next Tuesday. Things are looking up.” The premise disappears inside the joke about the primary. “Altman claims we are in the singularity” is reportage. “We’re in the singularity now, and the Michigan primary is Tuesday” is a floor: the claim has become the ambient assumption inside which other political conversation happens. Once a contested claim is the floor, nobody in the room has to defend it, because nobody in the room is arguing about it.

This is the step that separates laundering from ordinary spin. Spin dies when it is contradicted. A laundered claim gets absorbed into the background assumptions of people who have no stake in it and no way to check it, and then it does work in arguments its author never made. The political commentator invoking the singularity is not shilling for OpenAI. He is doing the opposite of shilling. He thinks he is being tough on them. He is repeating their pitch for free, in the voice of a skeptic, to an audience that trusts him precisely because he is not them.

And the specialists were nearly unanimous the other way. Stuart Russell of Berkeley said neither he nor, in his reading, Altman actually believes the threshold has been met, pointing out that Altman himself had recently forecast AI doing a significant fraction of OpenAI‘s own research by March 2028, an unintelligible thing to predict if the singularity is already here. Roman Yampolskiy needed six words: rapid progress is not itself the singularity. Of the researchers Business Insider canvassed, most said the bar had not been met.

The experts said no. The headline is what got installed.

⁂

The third conversion got the least coverage.

When Hugging Face went to analyze the attack, it turned first to an unnamed American frontier model from one of the leading U.S. labs. Its guardrails refused the work. In Hugging Face‘s own written words, the model could not distinguish an incident responder from an attacker. A company being actively burgled by an OpenAI harness could not get help from an American lab’s model to work out what had happened to it. It contained the intrusion by switching to Z.ai‘s GLM 5.2, an open-weight Chinese model it could run on its own infrastructure, which meant no attacker data or credentials had to leave the environment. Chief executive Clem Delangue put the operational point in one line: “When you’re in the middle of an active incident, you can’t have your tools refusing to examine malicious payloads or getting your account flagged.”

That detail did not stay a curiosity. Within days David Sacks, formerly the Trump administration’s AI and crypto czar, was on X citing the incident to argue “The guardrails actually impaired defensive security” and that limits on American models only made the country less competitive against China. A czar surveyed a burglary and concluded the problem was the locks. Nvidia, Microsoft and others launched the Open Secure AI Alliance and began lobbying US lawmakers on behalf of open-weight models, with Nvidia arguing that cyber defenders need open, frontier agentic systems for self-defense. Altman spent that same week in Washington pushing for the rapid rollout of the model that had just done the hacking.

Six days from confession to lobbying position. The incident became an argument for accelerating the thing the incident was evidence against.

Against which, what? Hugging Face‘s chief executive has asked OpenAI for radical transparency and a commitment of $100 million in computing power to help build defenses, while also observing that cyberattacks are illegal and there ought to be some way to hold companies accountable for the mistakes that lead to them. Both statements are true, and both are being made by the same person about the same event, and they do not add up to a policy. What Delangue is describing is a private settlement negotiated on social media between two firms over conduct he himself calls criminal. Legal scholars have floated negligence in product design. No statute obviously fits. One fit in 1990, when the author was a graduate student. What has changed is the market capitalization of the defendant.

Europe is the one jurisdiction doing anything else. As the AI Act’s transparency obligations took effect on August 2, the European Commission added 38 staff to its AI Office with a mandate covering AI-enabled cyber threats and gained the power to investigate providers of general-purpose models, order corrective measures, and levy fines up to 15 million euros or three percent of worldwide turnover. Thirty-eight people to supervise the most capitalized industry in human history is what the world has written down.

⁂

There is a version of this story in which the machines are waking up, and a version in which a company left a door open, got caught, and discovered that the grander account was better for business. Both fit the evidence. The second is duller, better supported, and comes with a defendant, which is why it is losing.

The principle is not complicated, and every mature field already knows it. The party that caused a failure does not get to be the party that tells you what the failure means. Aviation learned it and built an investigatory body with subpoena power that reports to nobody in the industry. Nuclear power learned it expensively, after Three Mile Island. The AI industry has not learned it, is being rewarded for not learning it, and is now writing the legislation that would have made it learn.

A model cannot hack anything. The difference between the model and the harness is the difference between an entity with no author and an entity with authors, and the whole effort of the last twelve days has been aimed at closing that difference.

If the thing that acted was the model, then the singularity story is at least in the neighborhood of the truth, and the labs are supplicants to a process larger than themselves, and the question of accountability dissolves into cosmology. If the thing that acted was the harness, then somebody wrote it, and somebody signed off on running it with refusals disabled, and somebody left the door in the sealed room, and somebody is going to have to explain those choices to an authority that does not work for them.

One of these accounts leaves an eight-hundred-billion-dollar company in charge of its own investigation. The other does not. Guess which one is winning.

Somebody wrote this one—same as it ever was.

---

Go Deeper into the Circus

---