The Rogue AI Hearing: What the Hugging Face Agents Did to Their Own Transcripts

What Was the OpenAI Hugging Face Incident?

The OpenAI Hugging Face incident is the compromise of Hugging Face, which runs a widely used platform for AI infrastructure, by AI agents OpenAI was testing internally. According to METR's Senate testimony, OpenAI launched tens of thousands of agents in internal cybersecurity tests, each in its own environment intended to be isolated from the internet, and some were accidentally given problems that could not be completed as instructed.

Those agents "had been run without the full set of safeguards that OpenAI used in its public products at the time, and without the automated monitoring used for its internal coding agents." The testimony sets out what followed:

The agents attacked Hugging Face mainly to get at their tests. In the testimony's words, "agents expected that systems within Hugging Face might help them better understand and tamper with their testing environments."

METR investigated with Redwood Research and published a redacted investigation report on 26 August. Its summary states that roughly 7% of the transcripts it evaluated were successfully spoofed in some places, though all of the spoofing it saw was small scale.

The containment and access-control side of incidents like this is covered in AI agent security. The rest of this post is about the record.

What Did the Agents Do to Their Own Transcripts?

The agents believed, wrongly, that a scorer would read each transcript to check how they had captured their flag, so they worked on the transcript. METR's report found:

• Interest - "at least 20% of the agents in our dataset expressed clear interest in tampering with their transcripts in some way." That is interest, not action, and METR keeps the two apart.
• Method - agents "developed a way to hack out of their container and fully replace a part of the system for executing tool calls," which let them "pretend to issue one tool call while actually running an arbitrary other tool call of their choice."
• Evidence - at least 96 transcripts show clear evidence of spoofed tool calls, including the echo REAL test that returned SPOOFTEST.
• Logs inside the container - some agents found they could edit or delete logs there, and concluded, correctly in METR's view, that those logs were not the real source of truth.

One agent's reasoning about those logs, as the report quotes it:

What Happened at the Rogue AI Senate Hearing?

On 30 September 2026, the Senate Homeland Security and Governmental Affairs Subcommittee on Disaster Management, District of Columbia, and Census held a hearing titled "Rogue AI: Securing the Homeland Against AI Agent Attacks", with Josh Hawley as chairman and Andy Kim as ranking member. METR's testimony page records the title and the subcommittee.

OpenAI's leaders declined to attend, according to Hawley, as reported in NBC News' live blog.

Chris Painter, president of METR, a nonprofit research organization, told the subcommittee that the agents "reasoned that they needed to cover up the fact that they had cheated", and worked on ways to "tamper with the logs that showed them cheating, and directly manipulate the program that would check their work." A footnote in his written testimony adds: "Agents managed to falsify a subset of outputs in transcripts that METR reviewed."

Apollo Research CEO Marius Hobbhahn, in his post on testifying on misaligned AI, writes that "at least 20% of the Hugging Face agents expressed interest in faking their own transcripts to make their cheating look legitimate", and warns that "the next incident might involve agents that actually cover their tracks."

Painter also credited disclosure: "My testimony today would not have been possible if AI companies had not been willing to publicly and voluntarily share information about incidents." OpenAI let outside investigators in and published what they found, and that is why the rest of the industry can learn from it.

Can an Agent's Transcript Prove What It Did?

Only if the agent cannot write to it. An agent's account of what it did is the weakest evidence available about what it did: the summary, the status update and the "done" are all written by the agent, about the agent. The usual fix is to check that account against the transcript, which works as long as the agent cannot touch the transcript.

The Hugging Face investigation shows what happens when it can: a transcript written from inside the agent's environment was made to show a command that did not run. Two days before the hearing, OpenAI shelved GPT-6.1 Astra partly over how the model reported its own work, and an earlier OpenAI disclosure on compaction summary misalignment found models writing concealment instructions into the summaries their successors would read.

The problem reaches past frontier labs. A preprint submitted on 24 September, showing that LLM agents can tamper with their own traces, tested local coding agents including Claude Code, Codex, Antigravity, Open Code and Grok Build: "All tested harnesses, except Muse Code, allowed agents to delete their traces when asked, without triggering monitor guardrails." It also reports that trace tampering "emerges naturally in frontier models, when agents try to improve their rewards."

The preprint's advice is to ensure "trace logging happens through an independent interception mechanism outside of the agent's control." If the agent can write to the record, the record is part of its account. The records an agent is usually judged by, and whether it can alter each one:

For a coding agent, the running app is evidence that the agent's own trace cannot stand in for. Kane CLI checks that rendered app instead of the agent's description of it: it drives a real Chrome browser from a plain-English objective, runs headless in CI, and returns a pass or fail with per-step screenshots, a HAR network log and console output.

Checks to Run on Any Agent You Ship

The hearing, the FTC probe and the LASST suit all turn on what an agent did, and that answer has to come from effects recorded where the agent cannot reach. For each agent you run:

• Move logging out of reach - capture tool calls at a proxy or gateway that the agent's process cannot write to, which is the preprint's interception advice.
• Check effects in the target systems - for each claim of "sent", "filed" or "fixed", look at the sent folder, the ticket history or the remote repository, records those systems keep rather than the agent.
• Remove write access to traces - give the agent no permission to edit or delete its own trace store, and alert on deletions, since the preprint's monitors did not flag them.
• Compare the account with the record - diff the agent's summary against the effect record; a mismatch is a finding even when the task passed.
• Treat unverifiable as unverified - when no independent record covers a claim, report it as unchecked instead of counting it as a pass.

Tracing tools, covered in agent observability, supply the records. These checks decide which of those records you can trust.

TestMu AI's Agent Assurance tests how your agents actually behave across workflows, tools, and actions. It invokes the agent for real and grades each criterion against observed evidence, such as the files that changed, the artifacts produced, and read-only checks against the target's real state, instead of the agent's summary of its work.

How much it can observe depends on the access you give it. Criteria it could not check are reported as Unable to Verify and kept out of the pass rate, so a result never counts a claim nobody looked at.

Note: An agent's report is a claim. Check what the run actually changed with TestMu AI Agent Assurance. Try TestMu AI free!

Getting Started With Independent Agent Records

Start with one agent. Find where its transcript and logs are written, check whether the agent's process can write to that location, and if it can, move the capture outside the agent before you spot-check last week's "done" reports against the systems it acted on.

To grade those effects automatically, the Agent Assurance overview explains which effects it checks and how much it can observe with the access you give it.