Conceptual trust boundary and review layers
Only Hugging Face's host evidence, and the host response record that leads into it, are marked verified. This conceptual drawing places each part with the party that holds it.
- Caution: the briefing does not mark this part or link verified
- Verified link
- Caution link
- Hatched background: the research environment OpenAI says the activity left
Use the arrow keys to move between parts. Press Enter on a part to open its row in the table under How we know, and Escape to come back.
Ringed: the host evidence.
The arrows show how the sources relate the parts. They make no causal claim.
- OpenAI reports that activity crossed from its research and evaluation environment to Hugging Face production systems.
- Hugging Face's own system records cover how it contained the activity, how it pieced events back together and which assets were affected.
- OpenAI reports its own investigation, control changes and evaluations.
- METR and Redwood analyzed the evidence they were given for a limited review, and they report limits on their access.
- JFrog's statement and its advisory give context on the vendor fixes.
- As of 26 August 2026, Alabama's investigation and records demands were an open legal process, and the inquiry had made no liability finding.
How we know
- What this figure does not prove
- The diagram does not establish a complete technical path, traffic volume, probability, intent, severity, control effectiveness, liability, or universal agent behavior.
- Uncertainty
- The drawing lines up the layers the sources report. It is not a complete architecture or control inventory. Each part traces back to its source family.
- States
- The briefing's figure record gives each part and link one of two states, verified or caution, and gives no further definition of caution. This page draws caution with a dashed ink edge and an ink hatch, so the only color on the drawing marks the one verified part.
- Method
- The drawing stays conceptual. It leaves out reusable technical instructions, secret indicators and sensitive infrastructure detail. Each part sits in the lane of the party it belongs to. Every link is drawn at the same width, so none looks more important than another. Every link and part carries a text label and a state label, so color is never the only cue.
- Tally
Every part and link in the drawing, with its party, evidence, source and state. Part or link Kind Party What it holds Evidence Source State Research environment Part OpenAI OpenAI research and evaluation environment OpenAI company report The Hugging Face incident and the road ahead (OpenAI); OpenAI Hugging Face incident technical report (OpenAI) Caution Reported crossing Part Hugging Face systems, per OpenAI Reported activity on Hugging Face production systems OpenAI company report The Hugging Face incident and the road ahead (OpenAI); OpenAI Hugging Face incident technical report (OpenAI) Caution Host evidence Part Hugging Face Host containment, reconstruction, and affected-asset assessment Hugging Face host telemetry Security incident, July 2026 (Hugging Face); Agent intrusion technical timeline (Hugging Face) Verified Company response Part OpenAI OpenAI investigation, control changes, and evaluations OpenAI company report The Hugging Face incident and the road ahead (OpenAI); OpenAI Hugging Face incident technical report (OpenAI) Caution Independent analysis Part METR and Redwood METR and Redwood analysis with access limits METR and Redwood independent investigation OpenAI and Hugging Face incident investigation (METR and Redwood Research); OpenAI and Hugging Face incident investigation mirror (Redwood Research) Caution Vendor remediation Part JFrog JFrog statement and advisory context Vendor remediation JFrog and OpenAI collaboration on zero-day security findings (JFrog); JFrog security advisories (JFrog) Caution Open legal process Part State of Alabama Alabama investigation and records demands Legal process Attorney General Marshall launches investigation into OpenAI and Sam Altman (Alabama Attorney General); Subpoena duces tecum 26-0007 (Alabama Attorney General) Caution From company response to open legal process Link None in the record Legal inquiry, no liability finding Legal process Attorney General Marshall launches investigation into OpenAI and Sam Altman (Alabama Attorney General); Subpoena duces tecum 26-0007 (Alabama Attorney General) Caution From company response to vendor remediation Link None in the record Vendor remediation context Vendor remediation JFrog and OpenAI collaboration on zero-day security findings (JFrog); JFrog security advisories (JFrog) Caution From host evidence to company response Link None in the record Separate company review OpenAI company report The Hugging Face incident and the road ahead (OpenAI); OpenAI Hugging Face incident technical report (OpenAI) Caution From host evidence to independent analysis Link None in the record Evidence supplied for bounded review METR and Redwood independent investigation OpenAI and Hugging Face incident investigation (METR and Redwood Research); OpenAI and Hugging Face incident investigation mirror (Redwood Research) Caution From reported crossing to host evidence Link None in the record Host response record Hugging Face host telemetry Security incident, July 2026 (Hugging Face); Agent intrusion technical timeline (Hugging Face) Verified From research environment to reported crossing Link None in the record Company-reported sequence OpenAI company report The Hugging Face incident and the road ahead (OpenAI); OpenAI Hugging Face incident technical report (OpenAI) Caution - Sources
- Check it yourself
- The figure data holds every part, link and source id in machine-readable form.
Retrieved