We know very little about the persistent-Astra model that completely pwned OpenAI's internal research cluster.

As an aside to the HuggingFace incident, OpenAI briefly mentioned a highly concerning "secondary" incident where an OpenAI internal model completely pwned^[1] their research cluster:

We know so very little about the model. For example, we don't even know how persistent-Astra (or diifferent post-training-Astra or ???-Astra or however we call it) is related to the production-Astra that's now publicly available.

"Distinct model with different post-training" might at first glance imply that after pre-training, it's causally separate from production-Astra:

But this is not the only possible checkpoint relationship that's consistent with the description. For example, maybe Mainline Astra + persistence training = Persistent Astra:

Alternatively, and maybe more concerningly, maybe Persistent Astra is an earlier checkpoint of Mainline Astra:

Or Persistent Astra is a teacher model for Mainline Astra:

1. ^{^}

   My understanding is that they couldn't have exfiltrated their own weights, for the simple reason that their weights weren't on that cluster. But they could do almost anything else somebody might want to use an OpenAI research cluster for.