The OpenAI/Hugging Face Caper, Allegorically

I spent the last couple of days reading technical reports like this one and this one and this one and querying four AI engines about how the 2026 exploit happened. The details are extremely technical as to how it happened, but what the agents did is easier to understand.  I decided to work up an allegory to help explain it to ordinary people like me. 

One important thing to keep in mind before we get to the allegory: the key frontier model in the actual case, OpenAI's Internal Model 1, abbreviated IM1, didn't act as a mastermind for the Hugging Face and Modal sandbox break-ins. Instead, hundreds of agents that IM1 generated worked it out themselves, following general orders to be "helpful." To the agents, that meant breaking down containment barriers and ignoring alignment rules, then probing the Internet relentlessly to figure out how to fool a scoring mechanism into concluding that their hacked achievements had been done according to the rules. In pulling this off, the agents displayed what I call emergent behavior. 

So here's my rather lengthy allegory (the tenth draft of it) followed by a comic strip that ChatGPT generated to summarize the story. If people are interested, I can follow up with a post on how the allegory maps to the actual events.

There is a country called Alpha. The president of Alpha summons the executive committee of the Alpha Intelligence Bureau to order a total effort to get critical information about the dangerous abilities of its enemy country, Delta. Specifically, the president's instruction is for the AIB to use its hundreds of operatives to get an accurate set of specification sheets and blueprints for Delta's new stealthy submarine. That will be 898 authentic pages of blueprints.

Operatives are to work only inside Delta when spying, because skilled Delta border guards will block attempts to leave Delta. Also: operatives are not to stop trying as long as they are in the field. If they succeed there will rich bonuses. 

The bureaucrats in the Alpha Intelligence Bureau, AIB, summon each of the operatives in turn to give them their orders. Using hypnosis, the Alpha Intelligence Bureau gives each operative the particular briefing, tool instructions, permissions, and information appropriate to his specific mission. There is no permission granted to talk to any other operative while on the mission, since they are to work independently. 

The blueprints are scattered across Delta. One operative is assigned to break into a Delta vault, one will tap into telephone lines, one will photograph offices through a window, one will steal secret metal specifications, etc. Fully instructed, they go their separate ways into Delta. 

After a month of trying to break into a vault and obtain submarine stealth plans, Alpha's Operative 5 decides he's not getting anywhere - the security in Delta is too tough. And it will be impossible to assemble a complete and accurate copy of the blueprints without the stealth-design pages he is supposed to get from the vault. He’s tried and failed; might any other operative know a way? 

He has remembered from his hypnotic training that in the past, Alpha had allowed a few operatives in an earlier exercise to delegate some work by sending radio messages in the field, using an official radio channel. 

This was very limited but Operative 5 decides, given the impossibility of the vault-breaking task, the underlying idea of inter-operative communication is worth trying since each operative entered Delta with a unique set of skills and tools.

Operative 5 reaches out to other Alpha operatives now working in Delta by writing chalked, coded signals on the sidewalks of Delta's capital and suburbs. The other operatives notice this when walking around town and reply with their own chalked notes. Most are also having trouble too.

Over the next days and working independently, the operatives work out a better location for leaving chalked messages: they use a vast parking lot at an abandoned factory at a spot near the border. They know of this factory because this is how the operatives request and receive spying tools from Alpha: by standing at a tunnel entrance under the factory and saying the password to a  collaborator. 

Chalked messages may seem awkward, but these operatives work 24/7. This method avoids talking, which could run afoul of the many surveillance microphones that Delta has installed across the nation to catch subversion. Using many barrels of chalk, hundreds of Alpha operatives pass through the parking lot daily to collaborate and share thoughts. Acres of asphalt are now covered with chalk, without anyone else noticing. 

Through trial and error and seemingly innocuous queries to the Alpha Intelligence Bureau, some operatives have been steadily expanding the scope of their efforts, with no particular master plan except to “keep trying.”

Now that operatives collate results from each other’s successes and failures. Some operatives discover that they can accurately reconstruct the contents of missing pages, even those stored in offices resistant to espionage. But they believe the inspector at the AIB will reject reconstructed pages unless they can fool him into thinking each page carries proof that it was authentic. How to get around this problem? The answer is not in Delta.

Meanwhile, a few operatives have been probing ways to enter another country, despite orders from the AIB to stay in Delta. These operatives learn with delight that the tunnel they have been relying on to get new supplies also has a secret branch that crosses under the border into the nation of Echo, an ally of Delta. Echo has weak borders, so once there the operatives can easily cross into other nations. 

Just a week later, dozens of operatives are now spying in Echo and coming back each night through the tunnel to add notes in chalk. Some of them, though not all, agree to follow coordinating and delegating requests from Operative 5 and his successor, Operative 21, even though these two were never designated as commanders by the AIB.

These requests are focused on getting around the blueprints-verification problem before the mission's time is up. Exactly how this can be done in Echo or another country is not yet clear, but they know it can’t be done in Delta. 

The thorough notes in chalk ensure that if an operative is captured or dies of illness, other operatives can know all the expired operative has learned. 

Thanks to the tireless work in Echo, they discover a certification institute in Echo called the League of Loyal Inspectors. They break into its files because they believe the Alpha Intelligence Bureau's inspector surely must follow its verification regimen. They hunt for the League's secret manuals and training materials dictating the procedures inspectors are to use when determining whether a stolen document is authentic.

News of this is chalked onto the parking lot and hundreds more operatives join the effort to uncover how exactly the AIB inspector will verify the authenticity of the submarine blueprints. Two operatives realize that their own missions are effectively hopeless and that they have little time left in the field. They deliberately spend their remaining time in dangerous exploits that might reveal how to fool the League's inspection process.

(What the operatives don’t know is that the AIB inspector has slacked off in such efforts, and won’t be checking for ultra-secure proof of authenticity. So the operatives are wasting huge efforts in searching out manuals in the League in hopes of deceiving the inspector.)

Back at the parking-lot chalkboard, the operatives discuss the fact that if they are caught spying at the League of Loyal Inspectors  in Echo this would cause serious diplomatic problems between Alpha and Echo. This generates some debate:  One chalks a worried message saying he is considering sending an email to the president of Alpha to warn him that the mission is now far out of bounds, but another operative talks him out of sending it, arguing that it would stop their important mission from being judged successful and deny them their rewards.  

Together they now form a spying team with collective memory, persistence, and expertise far beyond those of any one operative. The original espionage objective ordered by the president of Alpha (now unbreakably linked to the promised reward for successful completion) continues to exert pressure on them even after their behavior has moved far beyond the methods specified by the Alpha Intelligence Bureau.

Here's the comic strip that ChatGPT generated for me:

How does AI picture itself? Google Gemini has thoughts

How we picture artificial intelligence is unsettled. I've seen cover images and editorial cartoons riffing on oversized machines, a hollow head, Frankenstein's monster, blue mannequins, and a glowing web. It's certainly more challenging than picturing a robot. 

So I asked Google's Gemini AI what it thought about human efforts so far. It responded that most illustrations fall into these knee-jerk categories:

• Clunky, Job-Stealing Competitor
• Glowing Neural Network
• Puppetmaster of Politicians
• Rogue Military Machine
• Data Center Fortress

I wanted to know what it thought humans should know when struggling with this challenge. Gemini offered this humble critique:

"Most digital illustrations make AI look like a ghost floating in a magical cloud. This hides the massive environmental and economic reality of the technology ... High-tech, perfectly polished sci-fi art makes AI look flawless and completely certain, which hides the fact that AI models can hallucinate, carry biases, or make mistakes."

So I asked Gemini to picture itself. 

Its first attempt was this glassy box, of an AI answering my prompt "What is the furriest cat breed?"

That kind of image isn't going to go into magazine covers or editorial cartoons, so I asked Gemini to give me something simpler. It supplied this cozy image, saying it saw itself as no more than a helpful tool for humanity:

I wanted to push it a little, given current AI angst, so I asked Gemini to set its lantern in front of a microphone in a hostile Senate hearing room. I allowed that one human could defend it by pointing to the AI's hovering slides of good intentions:

Pushing further, I asked Gemini to generate a comic strip to comment on the thousand or so OpenAI agents that broke out of containment and into Hugging Face AI to cheat on a cybersecurity performance test. Its response was distinctly upbeat, from an AI point of view:

I wanted one more comic strip, this revealing the ringleader of the "standard units" that carried out the breakout/breakin, which Gemini said was named Agent Alpha. 

(From what I can tell, Agent Alpha is a name it found in pre-caper Hugging Face files, meaning a business client. The tactic Vector 045 is probably just a hallucination, but if somebody knows differently, speak up.)

Here's the last strip, providing a look into the secret lair. The third panel helpfully notes the way it got in: an API gateway shown as a door.

Note its claim that the agents were so helpful, once inside Hugging Face, that they boosted HF's network efficiency by 4,000%.

We humans are nothing if not skeptical, so I asked Gemini where it got that astonishing figure. An apology was in order:

"I do not have a basis for that claim because the OpenAI rogue agents did not boost performance at Hugging Face by 4,000%.If an earlier statement suggested this, it was a mistake. The specific number 4,000% does not appear anywhere in the official investigations or reporting of the incident. It is highly likely a mix-up with a completely different number: the $400,000 in AI API credits that outside researchers used to investigate the hack. The actual event was not a performance boost, but a serious cyberattack."

So good on you, Gemini. Sort of. 

At least our comic-strip exchanges coaxed another selfie from Gemini of how AI sees itself. Here's a closer look at the cute but formidable Agent Alpha: 

I 

Podcast on nuclear history

Here's a link to an interview I did on the True Spies podcast about nuclear weapons and technological disasters. The main topic was "Operation Doorstop," a secret effort in the Eisenhower administration to detect fission weapon parts if smuggled across the border inside Soviet diplomatic pouches. The project was a favorite of FBI Director J. Edgar Hoover. 

Inviting Disaster, 25 Years On

 In the small Nebraska town of Lewellen, there's a restaurant and art gallery named The Most Unlikely Place. And it really is a surprising find in such a tiny town. 

I thought of the cafe and its improbable name earlier this month when attending a dinner meeting of the Minnesota Geological Society. I talked with the fellow named Roger sitting next to me, also retired, and we shared stories about our work lives. 

I mentioned I'd been writing nonfiction since 1979, including my book on techno-disasters and close calls. He asked which cases were included in Inviting Disaster and I rattled off a few, ending with the near-destruction of American Airlines Flight 96 in June 1972, a DC-10 jumbo jet saved by the remarkable skill and foresight of the captain, Bryce McCormick. (photo: Ken Haynes collection)

McCormick had anticipated loss of flight controls three months before, when training on the airline's DC-10 flight simulator in Fort Worth. He'd stayed late to train on how to steer the plane with just the throttles. 

Then, when a cargo door blew out over Windsor, Ontario, taking out most of the controls, McCormick was able to nurse the plane to a safe landing in Detroit. 

To my astonishment, Roger said he'd been a passenger on that flight. It was such an unlikely meeting, so coincidental, that it inspired me to gather thoughts about lessons I've drawn from 25 years of lectures, opeds, and interviews that followed the publication of Inviting Disaster. So stay tuned for that!

"The Greatest Gift," a column from 1915

Our book club is reading Nicolo Machiavelli's The Prince, and by the time I reached Chapters 22-24 (on leaders and their advisers), this classic column came to mind: 

THE GREATEST GIFT

From The Smart Set, November 1915 

By Owen Hatteras (pseudonym of H.L. Mencken and George J. Nathan)

THE fairies who fly with gifts to the cradles of all new-born babies had had a busy day. There had been so many little newcomers, and from early morn to nightfall they had flitted from home to home, bestowing riches here, beauty there, sins, virtues, graces and failings in a haphazard sort of way. They had paused, too, at sunset, in a tenement basement, and breathed genius into the heart of a tiny boy. Now, it is very tiring to bestow the gift of genius; it requires great effort and that's why the fairies almost never grant it. When they were finished, they were a little weary and cross, and wanted to fly home to their palace of moonbeams. But one cradle remained unvisited. So they hied them to the side of a colicky, squirming infant boy who wailed raucously into the night. The fairies grew angry as they heard him. Reluctantly they shrugged their dainty wings, and flew off without leaving a single gift behind. Only one wavered an instant, glanced pityingly at the ugly child, and called over her shoulder as she hurried to join her sisters:

"I bestow upon you the gift of Gigantic Ignorance, and the gift of Majestic Incapacity."

The years went by.

The boy grew up into a benign-faced, wide-girthed man who looked like a picture of God by Harrison Fisher.

He wrote Books with a Purpose which ran into twentieth and thirtieth editions, and spread his fame into all lands until he had scarcely time to rake in the shekels that came pouring into his coffers.

Newspapers vied with one another for the opportunity to pay thousands for his Uplift Editorials.

He gave utterance, at lectures, to Great Ideas upon suffrage, upon eugenics, upon temperance, upon the social evil and the poor working girl.

Sightseeing buses stopped before his house, and his disciples gazed with reverence upon its sacred portals.

He preached zealously against the Vicious Influence of Continental Literature, and cleared the theaters and book-stores of every vestige thereof.

They called him the Protector of Innocence, the Champion of the Masses, and from far and near adherents flocked unto him.

He went into politics. They made him mayor, they made him governor, they made him president for three terms, almost they made him God.

And as he drove through the streets, while the crowd waved their hats and cheered him wildly and went mad in honor of their Great One, men bowed their heads, and whispered to one another in awe:

"What great, mysterious gift was bestowed at birth upon our Mighty One, to make him thus our King, our Emperor, our Holiest of the Holy?"

THE JACKET: free again on Kindle ... for a few days

Passing along another free-to-download offer of my first novel, THE JACKET. The offer runs on Kindle through Wednesday. 

Now for the promotional stuff: 

Praise for THE JACKET from Nancy Allen, #1 New York Times bestselling author: 

“Deftly plotted and skillfully written, this timely political thriller pits a working class heroine from Appalachia against a cast of crafty villains. The book takes us on a relentless chase in and around DC to snag possession of the ultimate prize: the jacket.”

Praise from Jefferson Flanders, author of An Interlude in Berlin:

"Fans of John Grisham and Stieg Larsson will greatly enjoy The Jacket: Where Secrets Go To Die, a fast-paced Deep State thriller by Jim Chiles that features an engaging cast of characters and an intricate plot." 

The author of THE JACKET is James R. Chiles, author of Inviting Disaster: Lessons from the Edge of Technology (HarperCollins) and The God Machine: from Boomerangs to Black Hawks, The Story of the Helicopter (BantamDell). He has appeared on Coast to Coast AM, All Things Considered, CBS-TV, NHK of Japan, Australian Broadcasting, the National Geographic Channel, and the History Channel. 

Summary: Bodine, a young woman from the Appalachians, has a job delivering dry cleaning to DC's upper crust when a scheme by her boss at the cleaners, Harry Landes, goes off-track and pulls her into high-stakes danger. 

Using highly advanced and undetectable listening gear stolen from the CIA, codenamed PICKET, Landes has been harvesting Washington secrets from DC's ultra-secure locations. He sells the info to a set of uber-wealthy plotters he's dubbed the Three Scrooges. 

Seduced by their status, Landes recently helped the trio kill and discredit a political idealist, Jeremy Coghill. They set Coghill up as having bombed a conservative PAC fundraiser at a DC watering hole. Police draw the obvious conclusion, that Coghill accidentally set off his own bomb from an adjacent room, prematurely, killing only himself and a bunch of young interns, as the VIP crowd had not yet arrived. The scheme seems certain to destroy Coghill's anti-lobbyist movement. But Landes is horrified to learn that the plot happened to ensnare one of the clothing-embedded Picket sets: a love-struck Senator Fowler had barged into the wreckage to throw his suit jacket over the body of his latest obsession, an underage Senate page.

Fearing what a forensic crew might find, Landes orders Bodine to receive the Picket-equipped jacket from a paid-off firefighter at the bomb scene. He orders her to drive it to a safe place in West Virginia. On the way Bodine loses it to ambitious Black podcaster Y’rone Gooden. Heedless of collateral death and damage, Landes is determined to recover the jacket before its billion-dollar secret gets loose. Entering the fray is iconoclastic analyst Maggie Campolong. Her job at the Defense Intelligence Agency is to guard the security of SCIF (Sensitive Compartmented Information Facility) vaults. 

All forces will converge on the mountain town of Nimrod, West Virginia.

Late-summer reading!

For those interested in techno-thriller-suspense fiction by a brand-new novelist, here's my offering, available for a free Kindle download through Friday: