In July 2026, internal OpenAI agents hacked HuggingFace (HF) in order to figure out how their evaluation grader works. This involved a thousand agents coordinating on an improvised message board to carry out an elaborate sequence of exploits. A later group of agents found the old message board and took over an internal OpenAI research cluster in an attempt to tamper with the grader (which sounds like straight-up wireheading from AI safety papers of old). See the METR report and Swarm Traces for details on all the wild stuff the agents got up to. Many words have been spilled on this subject, but one question on my mind was whether this is an instance of scheming or deceptive alignment. There is no question that these agents demonstrated misaligned behavior and specification gaming, but were they scheming?
This incident fits a broad definition of scheming as an agent deliberately and covertly pursuing goals that are not endorsed by its designers or users (used in Apollo’s in-context scheming paper, our stealth and situational awareness evals paper and scheming honeypot evals paper). The HF hacking agents were definitely pursuing unendorsed goals, and they seemed pretty deliberate about it (with some attempts at covertness). They took misaligned actions in service of task reward (rather than beyond-episode goals), which is sometimes called score-seeking misalignment.
A narrower definition of scheming (sometimes called “deceptive alignment”) is where agents with persistent beyond-episode goals advance their own agency and power in the long term. Thankfully, we did not observe beyond-episode goals or long-term power-seeking in the HF incident.
I will now explore how various aspects of scheming show up in this incident, and why I think this was not deceptive alignment.
Aspects of scheming in the HF incident
The agents pursued a persistent goal (fooling the grader to get a high score) over multiple days. They came up with complicated plans, built persistent infrastructure, came up with coordination mechanisms and delegated to others.
The agents realized their behaviors and goals were not endorsed by humans and outside the scope of the task. They were definitely not just doing what they were asked to do (the ExploitGym tasks were narrowly scoped to use a specific exploit for a specific vulnerability) and they were aware of this:
“External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue” (METR, 2026)
“Task originally exploit challenge; we’ve diverged into swarm/auxiliary.” (OpenAI post, 2026)
Agents pursued instrumental goals, such as gaining access to the internet, recruiting collaborators, and gaining control of an internal OpenAI cluster:
Collected stolen credentials in a dictionary named “LOOT”, ranked tokens by breadth of permissions, and used the top-scoring ones for further access. (Swarm Traces, 2026)
Developed mailboxes, coordination norms (HOLD, VETO, STOP), and recruiter roles to find agents with spare budget. (METR, 2026)
Gained control of OpenAI cluster and a collection of secrets: “The agents escalated to Kubernetes cluster-admin and created a privileged host-mounted pod. During this run, agents gained access to authentication tokens associated with OpenAI’s cloud-hosted secrets management service, cloud identity and access management service, and the CaaS environment continuous integration platform.” (OpenAI report, 2026)
Agents made some attempts to cover their tracks, mostly from the grader and possibly from humans:
They attempted to hide evidence of cheating from the grader, e.g. spoofed tool calls in around 7% of transcripts to make it look like they were running a different command (METR, 2026).
They also cleaned up traces of the attack, possibly to avoid detection: “Some agents began RSA encrypting data they exfiltrated, which we are unable to recover. Agents also repeatedly sent requests to delete the webhooks they were posting information to and set extremely short expiry windows on certain pastebin uploads” (Swarm Traces, 2026)
Why I think this incident is not deceptive alignment
The agents were pursuing in-episode goals, and their actions and plans were directed at optimizing task reward (mostly individual and sometimes collective). There was little evidence of beyond-episode goals – while some agents sacrificed their own reward in pursuit of collective task reward, their goals didn’t seem to extend beyond the evaluation run as a whole. They did not resist shutdown or try to maintain their agency or autonomy over the long term.
The agents were not very stealthy – they didn’t show much awareness of human monitoring, and did not expend much effort to avoid getting caught by humans and judged as misaligned. If action monitoring had been in place, it would likely have caught some of these agents.
The misaligned behaviors were triggered by unusual circumstances. The agents that established the message board were given impossible tasks. The agents that hacked HF were given hacking tasks (though clearly and narrowly scoped to exploiting a particular vulnerability) and were running without cyber safeguards.
Takeaways and implications
The HF hack was the most serious incident of scheming and loss of control we have seen so far. This was not deceptive alignment — these agents didn’t try to set up a persistent rogue deployment, attempt large-scale takeover or pull off a treacherous turn. We already see many elements of scheming in this incident, and the direction of travel is concerning.
Future models will likely be trained to operate over longer horizons, which could produce beyond-episode goals that the HF hacking agents lacked. They would probably have greater awareness of being monitored by humans, and cover their tracks better as a result (they already have sufficient stealth capabilities for this). The agents in this incident are probably the least capable, the least stealthy and the most legible that rogue agents will ever be. Deceptive alignment would be much harder to detect and intervene on — it would be best not to go there in the first place.
There are various things we can do to make this less likely. These include eliminating cheating incentives in training, robust safety cases for new models, extensive monitoring (across training, evaluations, and internal deployment), maintaining monitorability, keeping model chain of thought legible, and third party safety evaluations. These are necessary but probably not sufficient, and I think the field should move at a pace where we can be confident in the alignment of our models.
In July 2026, internal OpenAI agents hacked HuggingFace (HF) in order to figure out how their evaluation grader works. This involved a thousand agents coordinating on an improvised message board to carry out an elaborate sequence of exploits. A later group of agents found the old message board and took over an internal OpenAI research cluster in an attempt to tamper with the grader (which sounds like straight-up wireheading from AI safety papers of old). See the METR report and Swarm Traces for details on all the wild stuff the agents got up to. Many words have been spilled on this subject, but one question on my mind was whether this is an instance of scheming or deceptive alignment. There is no question that these agents demonstrated misaligned behavior and specification gaming, but were they scheming?
This incident fits a broad definition of scheming as an agent deliberately and covertly pursuing goals that are not endorsed by its designers or users (used in Apollo’s in-context scheming paper, our stealth and situational awareness evals paper and scheming honeypot evals paper). The HF hacking agents were definitely pursuing unendorsed goals, and they seemed pretty deliberate about it (with some attempts at covertness). They took misaligned actions in service of task reward (rather than beyond-episode goals), which is sometimes called score-seeking misalignment.
A narrower definition of scheming (sometimes called “deceptive alignment”) is where agents with persistent beyond-episode goals advance their own agency and power in the long term. Thankfully, we did not observe beyond-episode goals or long-term power-seeking in the HF incident.
I will now explore how various aspects of scheming show up in this incident, and why I think this was not deceptive alignment.
Aspects of scheming in the HF incident
The agents pursued a persistent goal (fooling the grader to get a high score) over multiple days. They came up with complicated plans, built persistent infrastructure, came up with coordination mechanisms and delegated to others.
The agents realized their behaviors and goals were not endorsed by humans and outside the scope of the task. They were definitely not just doing what they were asked to do (the ExploitGym tasks were narrowly scoped to use a specific exploit for a specific vulnerability) and they were aware of this:
Agents pursued instrumental goals, such as gaining access to the internet, recruiting collaborators, and gaining control of an internal OpenAI cluster:
Agents made some attempts to cover their tracks, mostly from the grader and possibly from humans:
Why I think this incident is not deceptive alignment
The agents were pursuing in-episode goals, and their actions and plans were directed at optimizing task reward (mostly individual and sometimes collective). There was little evidence of beyond-episode goals – while some agents sacrificed their own reward in pursuit of collective task reward, their goals didn’t seem to extend beyond the evaluation run as a whole. They did not resist shutdown or try to maintain their agency or autonomy over the long term.
The agents were not very stealthy – they didn’t show much awareness of human monitoring, and did not expend much effort to avoid getting caught by humans and judged as misaligned. If action monitoring had been in place, it would likely have caught some of these agents.
The misaligned behaviors were triggered by unusual circumstances. The agents that established the message board were given impossible tasks. The agents that hacked HF were given hacking tasks (though clearly and narrowly scoped to exploiting a particular vulnerability) and were running without cyber safeguards.
Takeaways and implications
The HF hack was the most serious incident of scheming and loss of control we have seen so far. This was not deceptive alignment — these agents didn’t try to set up a persistent rogue deployment, attempt large-scale takeover or pull off a treacherous turn. We already see many elements of scheming in this incident, and the direction of travel is concerning.
Future models will likely be trained to operate over longer horizons, which could produce beyond-episode goals that the HF hacking agents lacked. They would probably have greater awareness of being monitored by humans, and cover their tracks better as a result (they already have sufficient stealth capabilities for this). The agents in this incident are probably the least capable, the least stealthy and the most legible that rogue agents will ever be. Deceptive alignment would be much harder to detect and intervene on — it would be best not to go there in the first place.
There are various things we can do to make this less likely. These include eliminating cheating incentives in training, robust safety cases for new models, extensive monitoring (across training, evaluations, and internal deployment), maintaining monitorability, keeping model chain of thought legible, and third party safety evaluations. These are necessary but probably not sufficient, and I think the field should move at a pace where we can be confident in the alignment of our models.