Incident response is also fundamental to cybersecurity.

🟠 On June 27, OpenAI's response staff investigated agents' use of Artifactory as an improvised message board and concluded that "stopping the evaluation run was not required."
🟠 On July 4, agents' abuse of Artifactory caused it to crash. The particular bugs that agents exploited were patched, but OpenAI does not mention any change in basic system design or improvements in monitoring.
🟠 "Cyber evaluation workloads resumed on July 7," agents could access the internet on July 8, and Hugging Face was first compromised on July 11. OpenAI says that "leaders responsible for incident detection and response" after July 4 did not realize the significance of the shared message board.
🟠 On July 16, Hugging Face disclosed a security incident arising from "an autonomous agent framework (appearing to be built on an agentic security-research harness - used LLM still not known)." OpenAI reached out only to learn whether its own data had been compromised, drawing no connection to the described pattern and its ongoing internal workloads. (3/7)