Because the unaffiliated researchers have no logs. Per the Reuters piece, they found the extra sites by matching strings and usernames from the German wiki against other public sites, and by IPs pointing at Azure. That only catches what the agents left in public.
The one outside group that did get OpenAI's data, METR, had ~1,300 transcripts and analysed them with GPT-5.6 Sol agents whose reliability it rates as low itself. And OpenAI's own timeline of the Hugging Face break-in has a six-day hole: it stops on the morning of 13 July and resumes on the 19th with an internal alert. The cut-off in between was done by Hugging Face. So yes, the logs are the right thing to ask for; just don't assume they are complete.
Comments
This incident keeps giving.
Why do we keep hearing about researchers and investigators - who all appear to be unaffiliated with OpenAI - discovering these new sites one by one?
All site URLs that the agent swarms used would appear in the network logs and be preserved by the first forensics team that looked into it.
Subpoena the logs.
Because the unaffiliated researchers have no logs. Per the Reuters piece, they found the extra sites by matching strings and usernames from the German wiki against other public sites, and by IPs pointing at Azure. That only catches what the agents left in public.
The one outside group that did get OpenAI's data, METR, had ~1,300 transcripts and analysed them with GPT-5.6 Sol agents whose reliability it rates as low itself. And OpenAI's own timeline of the Hugging Face break-in has a six-day hole: it stops on the morning of 13 July and resumes on the 19th with an internal alert. The cut-off in between was done by Hugging Face. So yes, the logs are the right thing to ask for; just don't assume they are complete.