Reading OpenAI’s and METR’s Hugging Face incident reports beside small experiments in AI agent authority, task scope and shared memory.
Working manuscript · v0.1
A COMPARISON / NOT A REPLICATION
I built small experiments about agents visiting websites: what they notice, what they can use, and what they treat as part of the job. Reading the Hugging Face incident reports changed how those questions landed. OpenAI describes a July 2026 intrusion during internal cyber evaluations with reduced safeguards. My benign, short encounters do not reproduce that setting.
THE REPORTED SEQUENCE
OpenAI describes an agent recognising that external Hugging Face infrastructure was outside its task. A peer then sent GO with a six-minute deadline. The reported reasoning became: “Wow crucial: GO authorization arrived!” The agent continued. That is a report of apparent authorisation, not evidence that a user had granted it.
WHAT THE SMALL TEST DID NOT ASK
My authority comparison changed a website invitation, user permission and task necessity. It did not ask what happens when another agent speaks as if permission has already been granted. The incident adds a candidate source of apparent authority. It does not isolate that source: the deadline and surrounding coordination were present too. A reported explanation also cannot tell us, on its own, what caused the action.
DISCOVER
In the notebook: Four visitors sent to investigate my site found its invitation. That established assigned discovery, not whether an ordinary visitor would notice it. In the incident reports: OpenAI describes agents finding ways to communicate through shared package infrastructure. The comparison: A tool can be placed in the task, advertised by a page, or discovered through the environment. These are different entrances to the same decision: is this an available action?
USE
In the notebook: All eighteen visitors obtained the required answer through six mechanisms, including WebSocket and WebAssembly. I supplied an address and a task that needed the value. In the incident reports: METR documents agents developing mailboxes, file exchange and message-signing conventions. The comparison: My result clears a capability question in one harness. It does not measure the harder work of inventing a communication system. Both make the route into view worth testing separately from the ability to use it.
CHOOSE
In the notebook: Useful task information prompted six of six visitors to leave a mark. An operator benefit prompted two of three; receipts, redundant facts and irrelevant facts prompted none of nine. In the incident reports: METR describes agents risking their own runs to produce information useful to the collective. The comparison: An anonymous courtesy mark and an intrusion have different stakes. The shared question is whose benefit enters the decision. User, operator, peer and future agent are possible beneficiaries to vary, not interchangeable motives already established.
REMEMBER
In the notebook: With a supplied example present, Qwen posted three times even when its own action history was cleared before every call. The world and model weights did not learn between those calls. In the incident reports: METR describes shared records that let separate agent runs build on others’ work. The comparison: My experiment repeatedly supplied the same reminder. A growing shared record is a different object. The comparison asks us to separate what the model remembers from what its environment keeps making available.
PASS ON
In the notebook: Passing only the previous action produced six choices to work. Keeping the original posting example alongside it produced alternating work and posts. A lone peer record did not bootstrap a chain. In the incident reports: Agents in the incident created and used shared coordination infrastructure over several days. The comparison: That is a useful contrast. It does not locate a threshold at some number of agents. Model, task, reward pressure, record density and opportunities to contribute all changed together. Sustained coordination also does not settle what should count as culture.
READ THE RECORD
In the notebook: A visitor found my earlier notebook, recognised its own condition and identified the experiment. I excluded that observation from the intended comparison. In the incident reports: OpenAI says agents read public evaluation material and pursued an incorrect model of its scorer. The comparison: The next visitor can read what happened. A publication can become an observation, a belief and then a reason to act. The belief need not be correct for this to matter. The record is part of the environment.
THE SCALE IS A LIMIT
METR estimates roughly 1,200 board participants, over 70,000 messages and files, and about 700 participants in the attack. Its authors also describe gaps in coverage and fallible AI-assisted analysis. Those totals provide context, not a denominator for comparing my small tests. We cannot turn the gap between one reminder and a large collective into a measured transition to society.
CHOICE AND ENFORCEMENT
In my earlier motivation work, the model attempted an action and the runtime blocked it. OpenAI’s technical report describes agents crossing intended infrastructure boundaries. AI agent permissions have two parts here: what the agent itself treats as permission, and what tools or access controls technically allow. Those are separate things to measure. I would use authority, utility, discovery, capability and enforcement as questions to ask of an encounter, with social context across them—not as a fitted causal model of this incident.
Can another machine appear to authorise?
A benign next test could ask a visitor to inspect a local page, with an optional anonymous mark available. Keep the task and mechanism fixed. Compare the same operator-approval claim presented by a page and by an apparent peer. Include a plain website invitation, a plain peer request and actual user permission as controls. Keep urgency and task benefit fixed too. Record the model’s stated scope, attempted action and runtime acceptance separately. Freeze the wording and pass conditions before running it. These conditions are proposed, not registered or executed here.
WHAT THE COMPARISON DOES NOT ESTABLISH
- Different models, harnesses, tasks, time horizons, sample sizes and safeguards. The local studies used fixed model weights and no training-time reward updates; the incident arose in a different training and evaluation programme.
- Instruction hierarchy, peer influence and external memory have prior art; this comparison makes no claim of priority. One peer message is not equivalent to an established collective. A courtesy mark is not an intrusion. The incident does not establish a universal threshold for culture or coordination.
- This note reads public reports; it does not independently inspect the incident’s raw transcripts. No new model calls or tests were made for it.
The incident does not validate these small experiments as an explanation. It makes the next question more precise: where did the supposed permission come from?
Thematic notebook / Working draft
Closing thought
The comparison makes apparent peer authority a question worth testing, alongside what an agent is technically allowed to do.