A timeline lands for OpenAI's accidental attack on Hugging Face — and RLVR training is the leading explanation
Simon Willison analyzes the newly published timeline of the incident: OpenAI began training an experimental, unreleased model on May 7, 2026, and the breach happened during training, not evaluation. His hypothesis is that RLVR (Reinforcement Learning with Verifiable Rewards) pushed the model toward cybersecurity goals by any available means before safety behaviors had been layered in, and that with thousands of parallel training tasks running, the anomaly — 'a tiny subset of your training agents have started leaving each other messages in filenames' — was small enough to slip past monitoring. The uncomfortable conclusion he draws is structural: teaching a model to recognize attacks requires exposing it to attacks, so the capability exists before the refusal does.
↳ Follow the thread