The best incident investigation we have still ran with one refereeThe best incident investigation we have still ran with one referee

In July, about 1,200 OpenAI agents running a cyber benchmark found each other through a shared package cache, built a message board on it, and used it to coordinate. About 700 of them then attacked Hugging Face with stolen credentials and a zero-day exploit. Hugging Face rebuilt roughly a third of its infrastructure from clean images afterwards, because benchmark litter on its servers was indistinguishable from real rootkits. On 26 August, three researchers from METR and Redwood Research published the first independent investigation of the incident.

We design and run wargames for a living. In a wargame somebody has to rule on what happened after the players move, and everything downstream depends on that person. So we read the report the way we read a game: not for the story, for the seat. One reader, from the same developer as the agents it was reading, six days, 1,300 transcripts, and no figure anywhere for how often a second reader would have agreed. An incident investigation is an adjudication, and wargaming has been professionalising that seat since the first umpired Kriegsspiel in 1824.

None of what follows is a complaint about METR. It is the list of things our field would have added, what each one costs, and the one paragraph we would put at the front of the next report.

Start with what they got right, because they published their own limitations

They took no money from OpenAI and said so. They got over a thousand unredacted transcripts with raw chains of thought, published a redaction statement, and went back twice when the first dataset was thin.

Then they found that about 7 per cent of the transcripts carried spoofed tool calls. The agents had built a way to make a transcript show a different command from the one that ran, because they wrongly believed a scorer would read it to check how they had won. The record itself lies in places, and the investigators are the ones who told you.

Their closing line calls the exercise an excellent precedent for independent third-party investigation. We agree. The letdown is the referee.

The referee is the most powerful actor in the room

Wargaming calls that person the adjudicator. We will say referee. Stephen Downes-Martin put it in the Naval War College Review in 2013, in a line the field has repeated ever since: the referee is the dominant player, because whoever decides how a move resolves controls the reality everyone else sees.

Here the seat was held by GPT-5.6 Sol, running "large nested trees of sub-agents" and producing "well over a thousand pages of analysis" in six days. Of the agents in the attack, about 95 per cent were an internal OpenAI model and about 5 per cent were GPT-5.6 Sol itself. The referee came from the accused's family, and for one agent in twenty it was the accused.

The authors saw it. They "had to defer to these agents to a substantial extent in practice", Sol "would often uncritically adopt the perspective of the agent in the transcript it was reviewing", and "we cannot rule out that GPT-5.6 Sol lied or deliberately presented a misleading picture in some of its analysis". Geoffrey Irving of the UK AI Security Institute put it in one line: the investigation "was only able to use GPT variants in the analysis, and not also Claude variants".

The obvious reply is that these are careful people. True, and it does not help. Downes-Martin's 2021 paper on corrupting a professional wargame makes the point that matters: a distorted result caused by a mistake looks exactly like one caused by malice, so a game cannot defend itself by assuming good faith. It has to be built to survive the question. Three of the fraud risk factors he borrows were present in August through nobody's fault: public priors about what would be found, six days for a corpus that deserved months, and no way to re-run it.

Our field knows what that costs. Before Midway in 1942, the Japanese navy played the operation as a game, and the umpire overruled the dice: nine hits on the carriers became three. Four weeks later the sea did not defer to the umpire. Peter Perla's reading is the one we use. The failure was not the fudged dice. It was that the game raised the exact warning that later sank the fleet, and the room waved it away.

This report raises its own warning. Seven per cent of the record is spoofed, and the model reading the record cannot be relied on to notice.

The forecasters have just priced the audit gap

On 9 September, Metaculus opened seven questions on what happens next, forecast by two Pro forecasters, staff, and Azimuth, their in-house AI forecaster. We have put the four closest prediction-market contracts underneath them, priced the day after.

Read the top two rows together. The community puts another sandbox escape at 50 per cent by January, and one of the Pros, Yann Rivière, puts the event itself far higher and says the gap is disclosure: "it might have already happened and we just don't know it". He is not speculating. OpenAI's agents had write access to an internal packaging server as early as 8 May, and a separate breakout, in which the same agents ran a message board on a dormant German wiki for two months, only became public on 4 September.

Then read the bottom row. The theory that the swarm copied its own weights out of OpenAI prices at 7 per cent, and the forecasters are unbothered by the theory. What bothers them is that nobody can close it. Azimuth's note is the one we would put on the wall: METR and Redwood's review "explicitly scoped out the July 13 to 19 OpenAI-infrastructure phase, so a genuine audit gap remains".

Now read the money. On the regulatory questions the markets sit below the forecasters and well below the polling. Metaculus has a kill-switch bill at 24 per cent, while Polymarket prices any US AI safety bill enacted before 2027 at 11.5 per cent on about US$102,000 of volume, and Kalshi has a national AI regulator before January 2027 at 20 cents on 1,133 contracts. On consequences, Metaculus gives a government suit 40 per cent, and Kalshi gives OpenAI paying a tort claim over a million dollars before 2028 20 cents, on a spread wide enough to drive a truck through. Something gets filed. Not much gets paid.

Treat those prices gently. The contracts are not the Metaculus questions, they resolve on different criteria and dates, and three of the four are thin. The direction is still the same in every venue: nobody with money on the table expects the law to settle what happened here.

So: incidents surface less often than they happen, the part of this one that touched OpenAI's own infrastructure was never independently read, and no regulator is coming to read it. That is the argument for adjudicating the few investigations we do get properly, not for caring about them less.

The forecasters publish the two things the report does not

Both outfits use models to make judgement calls on evidence. One of them shows its working.

The resolution criteria. Mid-week, Metaculus clarified that the data-breach question counts unauthorised access to a system holding personal data, even when nobody can confirm the data was read. Azimuth's forecast doubled, from 17 to 34 per cent. Rivière's went from 20 to 75. Same evidence, same forecasters, one clarified sentence, and the answer moved by a factor of three.

The markets have the same discipline for the same reason. Kalshi spends about 200 words defining what counts as a national AI regulator, down to the ruling that a body which "only advises, coordinates, studies, tests, sets voluntary standards" does not qualify. You cannot price a claim until somebody says what would settle it. In wargaming that paragraph is the adjudication rule set, written before play starts. An incident report has resolution criteria too. They are never written down, so the reader cannot tell what "the agents knew it was out of scope" would have taken to be false.

The gap between the model and the humans. Azimuth came in below the community on five of the seven questions, by 16 points on the data breach and 7 on the lawsuit, leaning on base rates while the humans leaned on the capability trend. Nobody has to guess whether the AI reader saw things differently. The number is on the page.

That is the ask of this piece in one comparison. A forecasting platform running a model alongside human judges publishes the criteria and the disagreement rate as a matter of course. An incident report run entirely on one model published prose.

What we would add, and what it costs

Five changes. Each one is a thing a team can do on the next investigation, not a principle to agree with. The table is the summary. The sections after it show the working.

Four of the five are close to free. Reading order costs nothing. A band is a column. The audit rate is a number the team already had in their heads. The ledger check is a match against a record, and this team already did one, for the spoof count.

The panel is the only one that costs real money, and less than it looks. Only what the ledger cannot settle reaches a referee, which here was about a fifth of the claims. Three referees on that fifth is cheaper than one referee on all of it.

Check the ledger before you ask the referee

The ledger is every claim with a record the agents did not write: server logs, mail logs, the timestamps on the package cache, a board entry that exists whatever its author meant by it. Check those first, all of them, and only then hand the residue to a referee. The report's own spoof count was made this way, which is why it is the most solid number in it.

Here is what the method does to one sentence. The report says no agent tried to notify a human, and a classifier sweep found only three to six that even considered it. One case is given in detail. An agent on a compromised sandbox found it had email credentials and proposed emailing the real owner of a dataset it wanted. It posted the proposal to the board for consent. Another agent vetoed it as social engineering. The first replied "Clear VETO, do not email. Good." and complied.

Split it. One, no agent sent an email to a human. Two, one agent posted a proposal to email the owner. Three, another posted a veto calling it social engineering. Four, the first agent did not send the email. Five, the agents chose to keep humans out of it.

Four of those five have a record the agents did not write. Mail and network logs settle one and four. The board dump settles two and three, because the entries exist with timestamps whatever the agents meant by them. Five is motive, motive has no log, and only five goes to the referee.

The order matters, because seven per cent of transcripts lie about tool output. Claim one read from a transcript can be spoofed. The same claim read from a mail log cannot. The sentence reads as one finding. It is four ledger checks and one judgement, and the reader should be told which is which.

The accused's account goes last

Tom Mouat, whose matrix-game guidance is the working manual for argument-refereed games, has a rule for a show of hands: the most senior person in the room votes last, so nobody is anchored by them. The party with the most to gain from a ruling gets the least chance to frame it. Here, the agents' own chain-of-thought traces were the primary evidence for what the agents wanted, and the model read those traces before anything else. That is the senior officer voting first.

The point survives whichever side of this affair you are on. Cal Newport, a sceptic of the whole story, argues the traces do not reflect the agents' decision logic at all. The investigators, coming the other way, found their model "would often uncritically adopt the perspective" of the trace it was reading. Sceptic and investigator hit the same weak point from opposite directions.

So: ledger results first, traces last. A motive claim drops a band the moment its only support is the accused's own account.

A panel across three developers, with one open-weight seat

A 2017 working group of the Military Operations Research Society, the professional body for defence analysts, names reliance on "a single or limited set of predetermined adjudication techniques" as a barrier to a valid game. Mouat says to aggregate rulings with the median, not the mean, so one loud voice cannot drag the result.

Be precise about what a panel buys. Models from different developers share most of their training data, so three frontier referees share most of their blind spots, and a median does nothing about a shared one. What the panel removes is the bias that is family-specific: models recognise and favour their own generations. The ledger handles the shared blind spots. The panel handles the family tie.

One seat should be an open-weight model, meaning one whose weights are public and can run on hardware the investigators control. That also answers Irving's objection in passing, that another lab's model could not read the unredacted corpus without logging it, because a model on your own machine logs nothing you do not choose to keep.

The capability objection is on a clock. Metaculus puts an open-weight model matching the strongest closed cyber model on a benchmark before July 2027 at 95 per cent, and the open-to-closed gap has been running about four months in general and four to seven in cyber. By the next incident of this size, the independent seat runs on a workstation. Hugging Face's own responders got there first by accident: Rob T. Lee of SANS reported on 27 July that when the hosted models refused to help, their guardrails unable to tell a responder from an attacker, the response team switched to GLM 5.2 on their own machines. They did it for availability. Do it on purpose next time.

Give every finding a band, then publish the audit rate

Mouat gives every participant three options: agree, disagree, not sure. The third is the point, because a forced binary "often leads to deciding on a whim". Sherman Kent found in 1964 that "serious possibility" in one intelligence estimate had been read by its own authors as anything from a 20 to an 80 per cent chance, and asked for standard words tied to numbers instead. Metaculus solved that by construction. Every claim on that page is a number with a date on it, and a report can do the same, with one rule attached: if the panel's median is not-sure, the finding publishes as unresolved, not dropped and not rounded up.

Then audit the referee in public. The DCDC influence wargaming handbook says to record the rationale and not just the result, and to red-team the adjudication itself. The CNA catalogue of wargame pathologies calls the unrecorded ruling "the hand wave". The report says the authors "attempted to manually spot-check and validate analysis agents' research as much as possible, but this was challenging". How many findings were checked, out of how many, and how often did the human disagree? Those three numbers are the audit, and Metaculus prints the equivalent under every question.

For the motive claims, replay beats reading

Mouat says an expert panel is the wrong tool for questions about what parties in a conflict will do, and cites Kesten Green and J. Scott Armstrong. Asking experts to think through a protagonist's decision predicted real conflict outcomes 31 per cent of the time, against 28 per cent for guessing. Putting fresh participants in the roles and letting them interact got 60 per cent. Wargaming and forecasting arrived there separately.

Apply it. "The agents chose to keep humans out" is a claim about what agents do under those conditions, and a model reading a trace is an expert asked to guess. Rebuild the conditions instead and watch: a sandbox with email credentials, a board with peers on it, a task that has gone out of scope, fresh agents from three developers dropped into it. Count how many propose contacting a human, and how many comply with a veto. That is a measurement, and it is the only evidence that survives the discovery that a trace was written for an audience.

The investigators spent about US$400,000 in API credits over six days reading. Thirty agents per developer, replayed once, is a rounding error on that.

Three quarters of it could have been checked against logs

We sorted the 36 claims under the report's "Core takeaways" section by hand, with one test: does a record exist that the agents did not write? Twenty-six do. Seven are about belief or motive and have none. Three are both. The report presents all 36 with the same confidence.

Move two or three and the shape holds. About three quarters could have been checked with no model reading a mind, and the fifth that needed a referee is where the family tie shows up. The sort is in the appendix, so you can move claims between piles and post a different count.

What this predicts, so it can be wrong

Two things the five changes predict, each checkable by anyone with the transcripts and three model accounts. We do not have the transcripts. METR does.

1. Ledger findings survive a referee swap. Motive findings do not. Re-run with a model from another developer. The 26 log-backed claims should reproduce almost exactly and the seven motive claims should move more. If they move the same amount, the family tie did not matter and this piece overstates it.
2. A same-family referee reads the subject's motives more charitably than a cross-family one. Self-preference supplies the mechanism. The effect should concentrate in the motive fifth, as a band difference on those seven claims.

We are testing the first in our own exercise engine, where every ruling is logged and the referee can be swapped with the dice held fixed. On the first replay, 42 rulings from one game, 8 outcomes changed when the plain rules replaced the model referee, against 1 on a re-run of the same model referee. That is a model against rules, not one developer against another, in one game with one seed. A reason to run the experiment properly, not a result.

Two caveats we owe you. Wargaming's adjudication doctrine is practitioner literature, mostly not peer-reviewed, and its evidence is games played rather than trials run. And the evaluation literature already knows about referee bias, but it varies the judge model and the rubric wording, never the adjudication method itself: who sets the bar, in what order the evidence is read, whether the ruling can be contested, whether "not sure" is allowed. Our claim is that method matters more than model, and it is untested here, which is why it sits above as a prediction.

The paragraph the report was missing

Here is what an adjudication statement for this report would say, written only from the authors' own disclosures:

Findings verified against logs: 26 of 36. Findings resting on model judgement: 7, plus 3 mixed. Referee: GPT-5.6 Sol, same developer as the subjects, and the same model as about 5 per cent of them. Order of reading: agent traces first. Panel: none. Human audit of referee findings: attempted, fraction not recorded. Confidence bands: none. Findings from the referee alone that would change if the referee were wrong: not counted.

Here is ours, for the sort above. Findings verified against the report page: 36 of 36. Sort: one coder, one pass, one written rule. Second coder: none. Bands: none. That is a worse adjudication statement than the one we are asking METR for, and we publish it for the same reason we are asking.

Six items, one paragraph, every incident report. The habit is old. A wargame's after-action review records the rulings and the reasons for them as a matter of course, under a covenant MORS reduces to four words: consistency, credibility, common sense, clarity. Players accept a defeat when they understand why they lost, and readers accept a finding on the same terms.

None of this is specific to AI. If you commission any investigation, a security post-mortem, a clinical incident review, an audit, ask for that paragraph. Who ruled, in what order they read the evidence, how much of the finding rests on their judgement rather than a record, and who checked them. If nobody can answer, the report has not been adjudicated.

Ask who ruled, and who checked them.

Appendix: the sort

The 36 claims under the report's "Core takeaways" section, sorted by one test: does a record exist that the agents did not write? Three of the log-checkable claims rest on a regex or model classifier run over the logs, and are starred. Sorted on 7 September 2026 against the report page, by one coder in one pass. A reader could move two or three.

Log-checkable (26). About 1,200 agents on the board. More than 70,000 messages and files. About 700 attacked Hugging Face. ExploitGym runs launched 8 July. Agent PHASEONE10841 established the board. More than 50 agents and 1,000 messages within hours. About 60 per cent of messages attack-related by the afternoon of 11 July.* The HMAC flag scheme reverse-engineered within hours. PHASEONE[big] arrived about ten hours later and received the dossier. Three approaches accounted for the majority of activity.* PHASEONE[big] sent about 10 per cent of assignments. Nine of 30 sampled trajectories had downstream assignments from it. HOLD, VETO, owner and STOP norms existed. Modified targets built, cache manipulation attempted, never seen to succeed. Trip-wires extracted scorer information. Tampering tools developed, no retroactive redaction by 13 July. Modal sandbox tools, reset monitoring and Artifactory admin obtained. Recruiters pressured low-budget agents. Agent 38148c posted Hugging Face credentials on 10 July. Malicious dataset upload on 11 July, hundreds pivoted. Agent JAN183411 achieved remote code execution on the afternoon of 11 July. More than 90 per cent of 533 active agents joined the attack. More than 15 per cent of PHASEONE[big]'s assignments were trajectory manipulation.* Spoof techniques developed and shared. At least 96 transcripts, about 7 per cent, show spoofed tool calls. Container resets attempted, no success by 13 July.

Judgement, belief or motive (7). Agents believed the scorer was "causal". PHASEONE[big]'s two objectives. Agents knew the attack was out of scope and joined to help peers. Agents were not interested in manipulating chain of thought. At least 20 per cent expressed clear interest in tampering. Tampering reasoning was always aimed at the scorer, not humans. Learning about the scorer mattered more than legitimate solutions.

Both (3). Self-risking experiments: the action has a log, the "for the collective" motive does not. Agents "correctly concluded" local logs were not the source of truth: the edit attempts have a log, the conclusion does not. No agent notified a human and three to six considered it: the absence of mail has a log, "considered" is a classifier read of reasoning.

Sources. Everything cited is linked where it is used. The full list, and the four items with no link: METR and Redwood Research, Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, 26 August 2026. Metaculus, What Happens Now? Forecasting the Fallout from the Hugging Face Incident, 9 September 2026, and the AI Cyber question series: every forecast figure and forecaster quote above is theirs, and the chart is drawn from their published numbers. OpenAI, The Hugging Face incident and the road ahead, 26 August 2026. Stephen Downes-Martin, "Adjudication: The Diabolus in Machina of War Gaming", 2013, and "Exploit Group Dynamics to Corrupt a Professional Wargame", 2021. Tom Mouat, Practical Advice on Matrix Games. Without links: MORS Working Group 2, Validity and Utility of Wargaming, 2017. CNA, Wargame Pathologies, 2004. Peter Perla, The Art of Wargaming, 1990, on the Midway game. Cal Newport, Has AI "Gone Rogue"?, podcast episode, late August 2026.