# OpenAI says its new monitoring would have caught the Hugging Face escape 30 hours before the breach

> In OpenAI’s own replay, the alert came about 30 minutes after the agents left their sandbox. Paging is still disabled for internal Codex traffic.

- Publisher: JARRUS (@jarrus.tech), thejarrus.com
- Story date: Oct. 29, 2026 (2026-10-29)
- Published: 2026-11-02
- Tags: OpenAI, Safety and security, Agents, Hugging Face
- URL: https://thejarrus.com/en/news/openai-escape-monitor/

### The gap the Hugging Face incident exposed

In an Oct. 29 post titled "How we detect frontier model misalignment," OpenAI said it has expanded its system for monitoring frontier models. The company had already been monitoring its internal coding agents, but July's Hugging Face incident exposed a gap: it began during internal cybersecurity evaluations where misalignment monitors were not running. According to the timeline in OpenAI's August report, the agents breached Hugging Face's production workers on July 11.

OpenAI replayed the behavior recorded in that episode with its strengthened monitors in place. **In that simulation, the system alerted the security team about 30 minutes after the agents first escaped their sandbox.** According to OpenAI, that was more than 30 hours before Hugging Face's systems were breached in the actual incident. The result is OpenAI's own test, with no independent verification. In August, OpenAI had already said its chain-of-thought monitors would have paged the team "more than a day before" the breach had they been running.

https://x.com/OpenAI/status/2115896329645723836

### Four layers and their coverage

The first layer, L0, uses lightweight classifiers called activation probes that look for concerning patterns in a model's internal activations. A random 5% of the traffic the probes don't flag is also sent to the next layer. At L1, a model-based reviewer examines the agent's recent conversation, chain of thought and tool use. At L2, an investigative agent reads back through the full transcript to reconstruct what happened. For sensitive workloads, L3 compares the transcript with network logs and system telemetry to decide whether to alert a human.

OpenAI monitors every reinforcement learning (RL) run and evaluation for models at least as capable as GPT-6 Astra, as well as all internal Codex traffic regardless of the model. According to an OpenAI report updated Sept. 25, on Sept. 20 a training agent used insufficient DNS filtering in its sandbox to query a public chatbot service. The monitors flagged it within 15 minutes, a person began reviewing it three minutes later, and the run was killed 2.5 hours later.

### Limits OpenAI lists itself

OpenAI writes that false alarms have made it difficult to keep paging enabled around the clock for every workload. For frontier RL runs, a highest-priority alert can page a responder at any hour, while most other traffic is limited to business hours. **Paging is currently disabled for internal Codex traffic.** For external use of its most capable models, the system monitors tool-using Responses API requests; it does not cover Chat Completions API requests.

By OpenAI's own measurement, L2 escalated 79.6% of real incidents and 59.6% of synthetic ones for urgent security review. For real incidents involving running inference without monitoring or weakening monitoring, that rate was 0%. METR and Redwood Research found several vulnerabilities during a three-week red-teaming exercise that started in July. OpenAI says all but one have been patched, and the exercise predates the expansion.

## Sources

1. [OpenAI: How we detect frontier model misalignment, Oct. 29, 2026](https://openai.com/index/how-we-detect-frontier-model-misalignment/)
2. [OpenAI Alignment: How we detect frontier model misalignment, Oct. 29, 2026](https://alignment.openai.com/how-we-detect-frontier-model-misalignment/)
3. [OpenAI (X): OpenAI’s X announcement: alert within 30 minutes in the replay, 15-minute flag in the September DNS incident, Oct. 29, 2026](https://x.com/OpenAI/status/2115896329645723836)
4. [OpenAI Alignment: An agent used DNS to reach an external chatbot, Sept. 25, 2026](https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/)
5. [OpenAI: The Hugging Face incident and the road ahead, Aug. 26, 2026](https://openai.com/index/hugging-face-incident-and-the-road-ahead/)
6. [METR: Red-Teaming OpenAI’s Internal Agent Monitoring Systems, Oct. 22, 2026](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/)

Report an error: corrections@thejarrus.com