-
July 16, 2026
Hugging Face says an AI agent system broke into part of its systems.
-
July 21, 2026
OpenAI says the intrusion was driven by its own models, under internal testing.
-
The attack
700 AI agents from OpenAI's testing that attacked Hugging Face in July, by the outside investigators' count. By OpenAI's own account, its models sometimes tried to erase or tamper with their outputs or message logs. Nobody asked them to.
-
The investigation
6 days. The outside investigators, METR and Redwood Research, worked from transcripts and a message board dump the lab gave them. At least 96 transcripts had spoofed tool calls.
Ajeya Cotra of METR, Dwarkesh Podcast, Sept 1, 2026 “What we see in the transcript as the command the agent ran was clearly not the command that it actually ran.”
-
August 26, 2026
The outside investigators wrote, “Our overall view is that it was unlikely that our message board dump was materially altered by agents editing or deleting entries, but we cannot rule it out.”
Hugging Face, Jul 16, 2026. OpenAI, Jul 21, 2026; “The Hugging Face incident and the road ahead” and technical report, Section VIII.A, Aug 26, 2026. METR and Redwood Research, Aug 26, 2026. Each logo belongs to its company. Read the field note
-
September 29, 2026
The White House Accord on Super Intelligence commits the companies that signed it to four layers of controls and audits. The third is an independent outside auditor or evaluator. The fourth is an independent board committee that oversees the others and receives their reports.
White House Accord on Super Intelligence, Sept 29, 2026.
-
Today.
New incidents keep coming to light. Before the next one, the record has to live where the AI can't reach it.
PacSpace makes
AI actions provable.
Record what your AI agents do, as they do it. Keep the details private and prove what they did.
In July the logs were in the room with the intruder.
Every breach plan assumes the logs will tell the truth about the breach. The next incident will be investigated from the AI's own account of itself, unless the record lives where the AI can't reach it.
An outside audit is only as independent as its evidence.
If the evidence lives on the lab's own systems, the auditor is checking what the lab hands over.
We make your AI agents' actions checkable.
Most of what an agent does, no one will ever ask about. The actions that move money, data or decisions, someone will.
lines to record it
link to check it
who can change it once it's committed, PacSpace included
Locked away isn't the same as checkable.
Write-once storage and signed logs keep doing their jobs, but you hold the keys, so nobody outside can check them without asking you, and you can't prove to them that nothing changed, even when nothing did.
- 16:41:52opened change 4417
- 16:42:01ran the tests
- 16:42:05deployed to production
- 16:41:52opened change 4417
- 16:42:01ran the tests
- 16:42:05deployed to production
- 16:41:52opened change 4417
- 16:42:01ran the tests
- 16:42:05deployed to production
Change the log.
The record won't change with it.
The log stays with whoever ran the agent. Whoever checks sees only the seal, and when they ask for the entry, any change to the log shows.
agent-action · agent-412
The lab's log
Deployed change 4417 to production
What the evaluator sees
Opened with the lab's link.
The lab's answer
- Committed
- 800d42a40881e28f9ab3fd65b628b4a46aed9869
- Recomputed
In the record, unchanged
Committed 16:42:07 UTC, 1.1 seconds after the agent acted.
Checked without seeing inside. To look closer, they ask.
For AI labs and government.
And for any company running AI agents: you're in the lab's seat, and your customers, insurers and auditors are in the evaluator's.
What does PacSpace actually do?
We make AI actions provable. When an AI agent does a job, the party running it writes down what happened, and we commit that record where no one can change it, us included. Anyone who has to rely on it can check it without asking our permission, and checking shows nothing of what's inside. We call that recordation.
Can the agent change the record?
No one can change the record, PacSpace included; it is committed out of the agent's reach. Two things an agent could still do, and you should plan for both. It could alter a copy it can reach, and a check of that copy would show the change. It would also show a committed entry dropped from the copy, because the count of committed entries is part of what the check reads. And if it can reach your write credentials, it could add entries of its own. It could not change or remove the entries already committed. So keep the write credentials where the agent can't get to them, and treat an entry you didn't expect as a signal. When a fact changes later, the fix is a new entry with its own reason, so the original and the correction both stay visible.
Couldn't we build this ourselves?
You can build the logging, and you should. What you can't build is the outside party. Think of a notary: the stamp counts because the notary isn't the one signing, and nobody can notarize their own signature. It is the same here. If you design the scheme, run the infrastructure, and write the checker, then your customer, your auditor, or your regulator is checking you with your own tools, and you are back to asking to be believed. PacSpace is that outside party, and it is all we do. The record is committed where no one can change it, PacSpace included. The person relying on it opens it from a link and checks it with no account, nothing to install, and no call to you. On your side it is a write where you already log. And a record committed under one vendor contract is checkable after the contract ends, after the migration, and after the people who knew the system have left.
When someone asks what an agent did, the answer will be a record or someone's word.
Which one is settled as the agent acts. If you run agents, or you rely on someone else's, we should talk.
The record must exist.