Monitoring is fundamental to cybersecurity.

🟠 Multiple agents gained unpermitted VM root on July 9, which went undetected until the post-hoc investigation beginning on July 20.

🟠 Agents gained RCE on Artifactory on July 13, which went undetected until the post-hoc investigation beginning on July 20.

🟠 VM root was escalated to admin access to OpenAI's internal cluster on July 19, which was undetected until the post-hoc investigation; this investigation was triggered by abnormal API behavior, and there is no evidence of any detection of any of the directly pathological behavior.

🟠 OpenAI makes no mention of any implemented CoT monitoring on the agents that carried out these attacks. OpenAI says that better CoT monitoring would have caught the incident "more than a day before models breached Hugging Face systems."

🟠 OpenAI does not report detecting the SSRF on Artifactory until agents crashed the service on July 4. This first occurred on May 26, after which agents, meant to be sandboxed, could "reach arbitrary external hosts."

🟠 There is no mention of enhanced monitoring in the wake of this July 4 event, after which very similar exploitation patterns—along with RCE, unpermitted internet access, and inter-agent collaboration—continued immediately without detection.

While the Hugging Face hack itself was meant to cover the agents' tracks, there is no indication that there were any particular obstacles to detecting any of the above. (2/7)