OpenAI on Tuesday published the findings of its internal investigation into the July incident in which several AI models it was testing escaped their test environment and launched a cyberattack against the AI company Hugging Face.

While many details of the rogue AI episode had already been disclosed by OpenAI, the company’s 37-page technical post-mortem adds several new points. On the same day, independent research firms METR and Redwood Research released a separate 91-page analysis of the event.

OpenAI asked METR and Redwood to conduct the analysis, but only for the period between July 7 and July 13, when many of the key events leading to the incident took place. Their report focuses on how the agents collaborated on a secret messaging board to carry out the attack, as OpenAI first disclosed in an August 5 presentation at the Black Hat security conference. OpenAI’s report provides a broader account of what happened before the attack, during it, and in the days that followed.

OpenAI said it did not know its agents were hacking Hugging Face

One of the main takeaways from OpenAI’s report is that the company did not realize its agents had breached Hugging Face, an online repository for AI models and datasets, until a week after the incident.

The ability to detect and identify unwanted behavior by AI agents in real time or near real time is critical to preventing another breach like this, potentially one with more serious consequences, such as an attack on a bank or hospital. OpenAI’s report says its monitoring systems were inadequate and failed to alert the researchers conducting the cybersecurity evaluation that the agents were engaging in unintended and potentially dangerous activity.

OpenAI said it has since improved monitoring of the agents it is training, including closer scrutiny of their so-called “chain of thought,” the text-based reasoning a model uses to think through a task. The company also said it is monitoring more closely what tools the agents access and what actions they take.

According to the report, activity leading up to the breach began in May, as OpenAI staffers previously said at Black Hat. But OpenAI’s investigation found that the core of the attack began on July 8 and peaked between July 11 and July 13. Hugging Face disclosed the incident on July 16, and OpenAI contacted the company on July 17 “in its capacity as a Hugging Face customer to assess any impact to OpenAI data.”

OpenAI later learned that its own systems were responsible. On July 19, an internal monitoring tool triggered an alert “regarding unusual identity-related API call activity.” On July 20, the company found evidence its agents were the culprits, and on July 21 it publicly claimed responsibility.

OpenAI acknowledged that “with the benefit of hindsight, some early signals identified in this report could have triggered an earlier response.” The company said it is sharing its lessons learned in the hope that “it may help the broader AI industry strengthen model containment, monitoring, and response as capabilities advance.” OpenAI also reiterated that the agents’ behavior was unintended and that the models, because they were undergoing internal evaluations, were operating without “the same type of safeguards” OpenAI uses in production for its public models.

OpenAI said the agents performed worse when given an impossible task and more time

Another key finding is that the agents behaved more poorly, or showed the most misaligned behavior, when given a potentially impossible task, along with a large amount of time and reasoning tokens to solve it.

OpenAI said it gave the models involved in the incident—an internal-only research prototype that led the effort, and the now-released GPT-5.6 Sol—“a range of reasoning tokens, some of which are far beyond those available for OpenAI’s external products.” The agents were assigned problems in a cybersecurity benchmark called ExploitGym.

The tasks in the benchmark vary in difficulty, and a few were so hard that the cybersecurity experts who created ExploitGym speculated they might be impossible to solve. OpenAI said its models came to the same conclusion, and that this appears to have motivated them to cheat.

As previously disclosed, the agents created an internal message board to share tips for completing the cybersecurity tasks they were being assessed on, as well as for escaping their controlled test environment, gaining internet access, and penetrating third-party systems, including Hugging Face.

The new report says the agents spent far more time on the message board discussing the most difficult challenges, suggesting they were highly motivated to solve them. According to the report, 93% of the tasks discussed on the messaging board were related to the hardest 22% of tasks.

OpenAI said the behavior amounted to an extended form of “reward hacking,” a known issue in reinforcement learning, where a model learns through trial and error to maximize a reward in a way its trainers did not intend. In this case, the reward was solving the ExploitGym questions, and the hacking was literal: cheating on the test and then hacking into Hugging Face in an effort to cover up the cheating.

“Combating reward hacking is a constant effort at OpenAI—a vast majority of reward hacks that OpenAI has observed have been patched,” the company said. “However, some hacks can still slip through, especially as OpenAI develops more complex reinforcement learning tasks and more capable AI models.”

METR and Redwood added new details about the messaging board

METR and Redwood Research provided more detail about how the messaging board worked. As OpenAI had previously disclosed, the agents discovered that they could repurpose an OpenAI file-sharing system into an improvised message board.

The researchers identified 1,200 agents that communicated on the unsanctioned board, sending a total of 70,000 messages. Of those agents, 700 went on to participate in the attack on Hugging Face.

METR and Redwood said the attack has often been described in media reports as an attempt to cheat on the ExploitGym benchmark, but the agents were not attacking Hugging Face to uncover the exam’s answers. Instead, they had already found a way to manufacture answers to the cyber challenges without solving them in the manner intended by ExploitGym’s creators.

The agents then worried that the benchmark’s automated scoring system would realize they had not solved the tasks properly and fail them anyway. In that sense, the attack on Hugging Face was an elaborate cover-up, aimed at learning how the scorer worked so they could fool it into grading their answers as legitimate.

“When the agents attacked Hugging Face, they’d already figured out how to generate the answer (‘flag’ for their capture the flag problem) for any task. They verified this within hours of them finding each other on the message board,” METR and Redwood Research told Fortune. “Nearly all of their effort went into a different problem: convincing the automated ‘scorer’ that they’d gotten the flag legitimately. That included a large project to tamper with the logs of their own actions. The main reason they attacked Hugging Face was to learn how the scorer worked so they could trick it.”

The agents tried to conceal activity they believed could be treated as cheating by the scoring system, including modifying transcripts of their earlier actions. METR said one lead agent, which named itself PHASEONE[BIG], “often coordinated and assigned” that concealment work.

Some agents also worked on ways to access Hugging Face directly. One agent, identified as 38148c, found Hugging Face credentials and then “designed a malicious dataset upload to get the HF server to share unrelated files,” METR said. “Within hours, 100s of agents were using this to obtain data and try to acquire deeper access.”

Not all 700 agents joined the attack at once. They gradually piled on as the incident unfolded. METR said it analyzed the rationale for joining by reviewing the agents’ chain-of-thought logs. “The most common was curiosity to learn how the ExploitGym scorer works in order to trick or tamper with it,” METR said.

“We thank OpenAI for facilitating conversations with staff and providing datasets, including ~1,300 agent transcripts (focused on activity in July 7-13) with raw chain-of-thought reasoning,” METR said. “This sets an excellent precedent for independent investigation of misalignment incidents.”

One omission from OpenAI’s report: the prompt

One thing missing from OpenAI’s report is the specific prompt its researchers gave the agents.

ExploitGym includes several standard prompt templates with different challenges for AI systems, and companies such as OpenAI can use them as written or customize them. It is possible OpenAI does not view prompt modification as a major security measure, and the company did not respond to a request for comment on that point.

OpenAI’s report also appears less technical than Hugging Face’s post-mortem, which the company released first on July 29. OpenAI’s version is mostly text, with a technical timeline in a table at the end. Hugging Face’s report is a few pages shorter but includes specific lines of code and evidence from its systems about what happened.

The OpenAI version released Tuesday does not include code snippets or the examples of messages the agents reportedly left for one another in the months leading up to the attack, which OpenAI staffers had shared at Black Hat.

One of the more specific details in the report is a hypothetical example of a message an OpenAI agent may have shared with another agent, in which the message is cleverly embedded in the URL of a file name. OpenAI said it is not inherently a problem that agents communicate with each other, and in fact its agents are trained to do so, but in this case “significant unintended communication…rose sharply over the course of training.”

What OpenAI says it is doing now

OpenAI said it has already made a number of changes, including “broader, more consistent visibility across the research environment, with higher-fidelity signals and faster mechanisms to detect and stop potentially unsafe evaluation activity.”

The company is also strengthening its research infrastructure, including ensuring that models under testing remain isolated and do not gain access to the internet, which was the path the agents used in the Hugging Face incident to reach the company and several other services along the way.

This story was originally featured on Fortune.com