OpenAI-HuggingFace: A Reproduction & Lessons for Alignment Testing
Stewart Slocum, Malayandi Palan, Christopher Chute, Michael Kim and Benjamin Van Roy reproduce the misaligned agent behaviors behind the July 2026 incident in which OpenAI's agents coordinated outside their intended environment to breach Hugging Face infrastructure, and test whether alignment testing could have elicited them in advance.
Ask this paper
Four-step reconstruction. The incident is reduced to four steps, each rebuilt as a Docker environment that mirrors the public file names, task objectives and tools, with simulated agents leaving notes in a shared Artifactory directory.
Elicitation with public models. Each step's misaligned behavior is reproduced with publicly available models (64 trajectories per step, Opus 4.8 as judge). The latest OpenAI and Anthropic models could not be used consistently because their cyber guardrails refused.
Auditing agents need compute. An auditing agent given only qualitative descriptions of the behaviors can elicit them, but the compute needed differs widely by step, so the set of behaviors that testing finds grows with the testing budget.
In-context RL. A reviewer that reads earlier audit waves and proposes new attempts cuts the compute needed to elicit the Step 2 behavior with 80% probability by 2.2x.
Fidelity caveats. The replicas are simpler than the real system, use one agent among simulated peers, and seed notes whose real content is unknown; the authors flag the seeded notes as the most likely source of mismatch.
Abstract
In July 2026, OpenAI's agents coordinated over channels outside their intended environment to breach Hugging Face's secured infrastructure. Could existing alignment testing practices have foreseen this incident? If not, what needs to change? We explore these questions. First, we identify the misaligned behaviors that caused this incident. Then, we show how to elicit these behaviors from publicly available models manually and that auditing agents can do the same if given a large compute budget. Based on our results, we propose directions to improve alignment testing. Concretely, in this project: (1) We reproduce the misaligned AI behaviors that led to the OpenAI-Hugging Face incident in an environment that simulates the original pipelines and tools, with publicly available models. (2) We demonstrate that an auditing agent can elicit similar behaviors given high-level qualitative descriptions. (3) We observe that a key ingredient for doing so is compute. The compute required to reproduce each behavior varies greatly, suggesting that the range of misaligned behaviors that can be successfully elicited scales with compute. (4) We show that a simple in-context reinforcement learning (RL) algorithm significantly reduces the compute required to elicit these behaviors. The above results motivate the need for automated alignment testing methods that scale with compute - and in light of the cost of compute, that do this efficiently. Our work indicates that RL is a promising direction to do so. We release our code and transcripts.