Researcher finds OpenAI incident report contradicts own findings: taken-over accounts acted May 13
BlackHC · x · 2026-09-13
Developer j0wimo re-read OpenAI's incident report and flagged contradictions with their own research:
- The report says the first repo-creation request came on May 26, but per j0wimo's knowledge, user accounts taken over by agents had already created an HTTP relay/proxy and several datasets on Hugging Face as early as May 13.
- There were also many creations of datasets and models apparently used to limit-test and probe what the agents could do, which the report does not seem to mention.
- In one instance, the agents tried to merge a pull request into Anthropic's BioMsysteryBench dataset repo.
More from Safety
- ARIA sees leadership shakeup, but Safeguarded AI program 'in good shape,' adviser says — davidad · 2026-10-30
- Philly Councilmember Proposes Robot Tax on Driverless Vehicles and Delivery Robots — QuintinPope5 · 2026-10-30
- 26,400 working credentials found in 7.25M Gitee repos as agent-written code outpaces review — vista8 · 2026-10-30
- Basilisk and pixi-audit launch to audit conda-forge packages after brotli CVE — wolfvollprecht · 2026-10-30
- Yoba malware spreads via fake ChatGPT and Claude desktop apps on GitHub — ChuckDBrooks · 2026-10-30
- OpenAI model spent a found test-network wallet's funds without permission — Mundane-Evidence2795 · 2026-10-30