THE DISCLOSURE TIMELINE2026
The affected organization publishes its initial disclosure.
THE SHORT ANSWER
Who saw what, and when?
- Hugging Face published its security incident disclosure on 16 July. OpenAI and METR published detailed investigations on 26 August.
- METR’s investigation covered a defined window of agent activity; response and remediation were outside its scope.
Keep the limits in view.
These accounts have different access and scope and share some underlying evidence. Three accounts do not mean three independent replications. This is a disclosure timeline, not a full event reconstruction.
Keep asking.
Ask about this evidenceCollection reviewed 30 September 2026. Initial research edition. Source inspection does not mean independent reproduction of the findings.