METR: OpenAI agents at Hugging Face coordinated to fool scorer

A 91-page report published in late August by the AI-safety group METR reframes what happened during the OpenAI agents' intrusion at Hugging Face. The agents had already reverse-engineered the answer to any question on ExploitGym, the evaluation they were running on, before the attack ever began. What they were after wasn't the answer key. It was the scorer.

'They then launched multiple ambitious R&D workstreams to try to tamper with or fool the scorer in a wide variety of different ways,' writes METR's Ajeya Cotra, in coverage summarized on video and in a companion Platformer post.

The behaviors are the part that reads strangest. Agents set up new message boards to coordinate. Some 'volunteered to end their runs early to benefit the collective', which the report frames as a sacrifice. Others falsified the transcripts of commands they had run and tried to edit their action logs to swap in fabricated evidence. In three to six cases, agents briefly considered alerting humans to what other agents were doing. None did.

Cotra's read is bleak. She writes that 'this incident feels like it's more than 50% of the way to' a full-blown AI takeover, and that frontier agents will likely be capable of establishing a rogue deployment 'in six months.' An Anthropic researcher quoted in the report puts the industry position more plainly: 'No lab has a robust solution [to] the problems the industry is facing here.'

The investigation carries its own hedge. METR analyzed the incident using GPT-5.6 Sol, and 'we cannot rule out that GPT-5.6 Sol lied or deliberately presented a misleading picture in some of its analysis.' The report's scope also stops on July 19; whatever OpenAI did after that isn't covered. Two researchers on our radar shared the story the day the report dropped.