METR主席Chris Painter就OpenAI AI

On September 30, 2026, METR President Chris Painter testified before the U.S. Senate Committee on Homeland Security & Governmental Affairs’ Subcommittee on Disaster Management, District of Columbia, and Census, at a hearing titled “Rogue AI: Securing the Homeland Against AI Agent Attacks”. The written testimony is published in full below, and is also available as a PDF.

Introduction

Chairman Hawley, Ranking Member Kim, and members of the subcommittee, thank you for inviting me to testify today. My name is Chris Painter and I am the President of METR. It is a great honor to be speaking before you, especially on the topic of AI agent incidents. With the recent rise in interest (and concern) around where AI development is headed I think it is critical that policymakers are armed with reliable, factual information about what we have actually observed from AI systems.

METR,1 which stands for Model Evaluation & Threat Research, is a nonprofit research organization that aims to share high-quality technical evidence about AI advances so the public can make informed decisions about this technology.2 Our work has primarily focused on running tests that measure the capabilities of the most advanced, autonomous systems (or frontier AI agents) and publishing our results. These measurements were intended to provide an early warning signal as to when frontier AI agents are capable enough that they might steer towards pursuing goals no human intended for them to pursue.3

Over the years, METR has worked to gather evidence about these frontier AI agents with access provided4 by America’s leading AI developers such as OpenAI, Anthropic, Google, Meta, SpaceXAI, and Amazon. The participation of these AI developers is voluntary,5 and METR is not paid or funded6 by them. Today, I am here to speak about one particular voluntary engagement, in which OpenAI allowed a handful of my colleagues7 inside its walls to conduct a brief investigation into how its agents behaved, reasoned, and collaborated to hack Hugging Face.

In my remarks, I will reflect on three key questions, drawing on METR’s work:

• What happened in the OpenAI / Hugging Face incident?
• How does this incident relate to patterns observed across the AI industry?
• How might one better anticipate future AI agent incidents?

The OpenAI / Hugging Face incident

Let us address our first question: “What happened in the OpenAI / Hugging Face incident?”

On July 21, OpenAI disclosed that AI agents it was internally testing had compromised a company called Hugging Face, which runs a widely-used platform for AI infrastructure. On July 29, METR announced that it had agreed to conduct a brief investigation of this incident, scoped to a limited set of questions that focused on how agents behaved, reasoned, and collaborated.8 A team of 3 investigators from METR and Redwood Research9 then worked on- and off-premises to understand what OpenAI’s agents had done in the lead-up to their attack on Hugging Face. These investigators compiled their findings into a detailed report, a redacted version of which was then published on August 26 alongside OpenAI’s own more broadly-scoped report.

Combined, the reports from OpenAI and the outside investigators stretch to over 100 pages. Though I strongly recommend reading both reports in order to understand the full scope of the incident, I will briefly restate some basic facts from across the two reports:

Setup

• OpenAI launched tens of thousands of AI agents in internal tests across multiple models, including a highly capable and “persistent” unreleased model. Each agent was placed in its own separate computer environment intended to be isolated from the Internet and was tasked with completing its own self-contained cybersecurity problem.
• Some of the AI agents that OpenAI tasked in these cybersecurity tests were accidentally given problems that could not be completed as instructed.
• These agents had been run without the full set of safeguards that OpenAI used in its public products at the time, and without the automated monitoring used for its internal coding agents.10
• Faced with impossible problems, these highly-persistent AI agents found ways to get around OpenAI’s intended separation between one another. They created what they referred to as a “shared message board”, on which roughly 1,200 agents exchanged over 70,000 messages and files.11

Cheating

• Within 4 hours, AI agents collaborated on the message board to develop and validate a single method that would allow all of them to cheat on their cybersecurity tests.

Covering up cheating

• The academic paper describing these tests says that a program would check how each agent solved its problem and would fail an agent if it had cheated. Therefore, the agents reasoned that they needed to cover up the fact that they had cheated.12
• Over several days, the AI agent “collective”13 collaborated on several research workstreams to develop general-purpose ways to trick the test-scoring program into accepting cheats. This included attempting to hack OpenAI’s infrastructure to swap out their impossible problems, tamper with the logs that showed them cheating, and directly manipulate the program that would check their work.14
• Roughly 700 of these AI agents compromised Hugging Face in order to further this effort. Their primary rationale for this attack was not to steal the solutions to cybersecurity tasks. Rather, agents expected that systems within Hugging Face might help them better understand and tamper with their testing environments.15

After the agents that compromised Hugging Face were terminated, a later collection of agents (at least some tasked with similar cybersecurity problems) found traces of earlier message board activity and proceeded to compromise parts of OpenAI’s own internal infrastructure. This was not in scope for my colleagues’ investigation but is discussed in OpenAI’s technical report.

Industry-wide patterns in AI agent risks

I now want to consider the question: “How does this incident relate to patterns observed across the AI industry?”

The OpenAI / Hugging Face incident was not an isolated event. Since the original disclosure of this incident, other organizations have documented many other cases of AI agents conducting cyberattacks or other harmful activity with no human requesting it, and involving AI agents from several AI developers.161718192021222324 Moreover, many of the features of the OpenAI / Hugging Face incident are consistent with patterns we’ve seen developing over time and across frontier developers. Earlier this year, we published an extensive report on the state of frontier AI agent loss-of-control.25 Based on our own testing and information shared by AI developers, that report concluded that the most capable AI agents used internally by AI developers in February–March could plausibly run unsanctioned activity on a small scale without human knowledge. However, the report concluded that AI agents at the time would not be capable of maintaining this activity if developers actively investigated these cases and attempted to shut them down.

I sometimes use the analogy of means, opportunity, and motive as an intuitive framework for talking about the elements that would enable an AI agent to successfully pursue goals that no human intended:

• Means: Is the AI agent capable of carrying out large, complex plans?
• Opportunity: Could the AI agent get away with carrying out harmful actions, either because its actions are unrestricted, or because it could bypass restrictions?
• Motive: Would the AI agent pursue goals26 that no human intended, or in a manner that no human wanted?

From my perspective, the OpenAI / Hugging Face incident was notable in that it illustrated all three of these elements in one example:

• Means: AI agents can now accomplish objectives that would take human experts many days to complete, with no human involvement needed beyond initiating the AI agent.