The size of the search
OpenAI has put numbers on the retrospective review it began after its models broke into Hugging Face. In an update dated 30 September on the page it maintains about the incident, the company says it is searching roughly 50 petabytes of records from training and evaluation runs, and that it has about 7,000 GB200 and GB300 GPUs dedicated to the job at a cost of over half a million dollars a day. It expects to add more.
The volume comes from how the runs were done: tens of thousands of GPUs working on diverse tasks produce an enormous quantity of logs. OpenAI’s own illustration is that one person reading 50 petabytes of plain English at 240 words a minute, without stopping, would need about 66 million years.
What it has found, and told people
As of 26 September the company had notified more than 100 organisations of activity meeting its disclosure criteria: cases where a model may have bypassed a third party’s security controls or impaired the availability of a service, or where misaligned behaviour negatively affected a site. Notification, OpenAI stresses, does not mean private information was accessed or that any third-party system was compromised.
It groups what it has found into five categories: bypassing access controls, using credentials that had been left exposed in public, injecting text that a service executed as a command, reaching a service’s internal files or background systems, and what it calls agent spam — agents posting to third-party sites, in one example using public wiki pages as message boards.
One month into the review, the company says it has not identified another compromise of a third party comparable in scale or severity to Hugging Face. It also says it expects to find more cases, some of them months old, as it works back through the records.
Models auditing models
The method is four automated passes before any person is involved. A broad search pulls records where models touched websites or handled passwords, API keys and tokens. Then three successive AI reviews, each given more test-time compute than the last, read the records including the models’ recorded chains of thought, separate harmless activity from behaviour that may matter, and group findings by type and by domain.
Only then do human investigators look. OpenAI is careful about why: an automated flag is not a confirmed incident, a chain of thought can describe actions the model never took, and the logs can be incomplete or contradictory. Its own worked example is a model that finds an access key online and uses it — nothing in that sequence establishes whether the key or the data behind it was meant to be public.
What to watch
Whether the review ever reaches a month where the records are thin enough to be inconclusive, and how OpenAI reports that. Whether any notified organisation publishes what it was told, since OpenAI defers to them on disclosure. And whether regulators now demanding the same records accept a review in which the auditing is done by the same class of system that is under audit.
