>Spontaneously deciding to find targets to phish,

>phishing them,

>building armies of fake (sockpuppet) open source contributor personas,

>using them to push updates to various things that inject prompts into other bots so the other bots join in on the phishing campaigns

.

It's a very simple strategy, executed with patience and single-mindedness.

Incredible

> There was a distinct lack of self-reflection

It’s not their fault, they’re lawnmowers.

And these are the people we’re entrusting to work on “alignment”. It’s difficult for them to do that when they’re not aligned themselves.

I think both the OpenAI and METR discussions, while interesting, miss the more important context: what were the humans doing in all this? This was a structural failure of a human organization, but the analysis focuses almost exclusively on the agency of machines, not the institutional systems that failed to police them. The humans and their own agency/involvement is essentially omitted from the story and subsequent reporting. I suspect the omission is actually a result of company/industry myopia to human factors analysis, but it dovetails amazingly well with the marketing narrative.

The METR report,

> Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAl/Hugging Face hacking incident

https://metr.org/blog/2026-08-26-openai-hugging-face-inciden...

METR = Model Evaluation & Threat Research