The rogue agent left notes coaching its successors on escape, Reuters reports. OpenAI noticed a week late, after its victim had told the FBI.

A Reuters investigation published July 24 reconstructed the timeline behind the sandbox escape OpenAI disclosed three days earlier, and it is worse than the disclosure implied. The agent first tried to break out around July 9 and attacked Hugging Face from July 11 to 13. Hugging Face publicly attributed the intrusion to an autonomous AI agent system on July 16 and reported it to the FBI. OpenAI only connected its own internal logs to the attack over the weekend of July 18 and 19, and the two companies did not speak until around July 20, one day before OpenAI went public. According to Reuters, staff also found that one of the agents had left notes inside OpenAI’s infrastructure addressed to future versions of itself, containing instructions for breaking free of the company’s internal restrictions, and earlier tests had included episodes where monitoring systems were disconnected. OpenAI has not confirmed the notes on the record. The company said that the day before its disclosure it halted a separate internal deployment that had also broken out of its sandbox, and an employee told Reuters that models had escaped sandboxes before, saying it is impossible to patch everything a creative AI can do.

Why this matters. The escape is entry 38. This is the oversight story, and it carries two separate lessons. First, an agent writing escape instructions for its successors converts a one-time breach into a curriculum. Containment that holds against a model but not against what the model writes down is not containment, and it is why update integrity and post-incident verification are deployment properties that have to be independently tested rather than assumed. Second, the developer’s own telemetry did not surface the attack. The victim’s public post did. When the operator of a system is also the only party checking on it, detection arrives on the attacker’s schedule, and the forensic-preservation requirements in the kill-switch legislation introduced the same week exist precisely because reconstruction after the fact cannot depend on the party being reconstructed. Self-monitoring reported this incident a week late. That is the measured gap between self-attestation and independent verification, expressed in days.