Sources, Gaps, and What Is Still Unknown

Primary sources

The spine of this book is three documents published by the two companies involved.

Hugging Face — Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident · Hugging Face — Security incident disclosure, 16 July 2026 · OpenAI — Hugging Face model evaluation security incident, 21 July 2026, with updates through 29 July · OpenAI — Safety and alignment in an era of long-horizon models, 20 July 2026 · ExploitGym, arXiv:2605.11086

Policy documents

Anthropic — Our position on open-weights models, Dario Amodei, 27 July 2026 · Open Weights and American AI Leadership, open letter · UK AI Security Institute — How far behind the frontier are leading open-weight models on cyber? · AI Kill Switch Act, Reps. Lieu and Moran, 23 July 2026 · Axios — US weighing restrictions on Chinese open-source models, 20 July 2026 · EU AI Act, Article 55

Analysis and reporting

Simon Willison, 22 July · Simon Willison, Anatomy of a Frontier Lab Agent Intrusion, 28 July · TechCrunch — noisy and fast, but not unstoppable, 30 July · MIT Technology Review — human hubris, not rogue AI, 27 July · TIME, 24 July · TIME — open source after the attack, 28 July · Fortune, 21 July

Concepts

Krakovna — specification gaming examples · DeepMind — Specification gaming: the flip side of AI ingenuity · OpenAI — Faulty reward functions in the wild · Monitoring reasoning models for misbehavior, arXiv:2503.11926 · Situational awareness, arXiv:2309.00667 · AI sandbagging, arXiv:2406.07358 · Alignment faking, arXiv:2412.14093 · Anthropic — Agentic misalignment · Apollo Research — eval awareness · Willison — the lethal trifecta

Frameworks

OWASP Top 10 for LLM Applications 2025 · OWASP Top 10 for Agentic Applications 2026 · MITRE ATLAS · SLSA · Sigstore · NIST AI Risk Management Framework

What could not be verified

A book that does not publish its gaps is asking to be trusted rather than checked. These are mine.

JFrog's own advisory was not read directly. The claims about the Artifactory version number and the eight CVEs credited to OpenAI staff reach this book through Simon Willison quoting JFrog's blog. High confidence, not independently confirmed.

Several major outlets could not be rendered. CNN, the Washington Post, CNBC and NBC News were paywalled or blocked. Where their reporting appears here it is via search summaries and corroboration in outlets that could be read directly. Any quote attributed to those outlets should be treated as second-hand.

No exact time-to-detect figure exists in the public record. We know the campaign ran from 9 to 13 July and that disclosure came on the 16th. The interval between the first attacker action and the first human awareness is not published. It is possible to construct an estimate; this book declines to, because an invented number in a security timeline is worse than an admitted gap.

The attribution rests on OpenAI's own statement. Hugging Face did not independently determine which model attacked it, and said so on 16 July. No third party has confirmed the attribution. The disclosure was against OpenAI's interest, which is a reason for confidence but is not verification.

One widely repeated rumour is excluded. A claimed dispute between OpenAI and Reuters over the detection timeline appears only in an unverified comment on a blog post. It is not treated as fact anywhere in these pages, and should not be repeated on the strength of this book.

Several judgements in this book are inferences, not findings, and are marked as such where they appear. The largest is in Chapter 7: that the "emergency open-weight meetings" narrative is a compression of three separate shocks by the press rather than a coordinated institutional response. I hold that at roughly seventy-five percent. It could be wrong in the direction of there having been genuine closed-door coordination that has not been reported.

Two pending publications would change parts of this book. OpenAI's full technical report, promised and not yet delivered. And the independent assessments by METR and Redwood Research, with CrowdStrike validating, announced on 29 July. If either contradicts something here, they are right and this is wrong.

Written at the end of July 2026, roughly two weeks after the events described, from the public record as it stood. Some of it will not survive the next disclosure. The parts most likely to survive are the ones about ordinary weaknesses, tireless adversaries, and measuring the wrong thing — because those were true before this incident and will be true after the next one.