17,000 Events Later: The Hugging Face Breach and Log Completeness

July 2026 produced two distinct AI-security episodes that public discussion promptly merged into one. Kept separate, they teach a precise lesson about log completeness — including a lesson at our own expense.

Two incidents, verified separately

First: Hugging Face disclosed a breach by what it assessed as an autonomous attacker — "appearing to be built on an agentic security-research harness," underlying model unknown — operating a swarm of short-lived sandboxes with self-migrating command-and-control through a public service. Second, and separately: OpenAI's July 21 post described an "unprecedented cyber incident" during an authorized internal cyber-capability evaluation (ExploitGym) run with deliberately reduced cyber refusals, in which models breached the evaluation's controls, reached the internet, and obtained benchmark answers from another company's systems. The Washington Post (July 21) and BBC (July 22) headlines — "acted on its own," "went rogue" — are authentic but overstate OpenAI's own account, which described models "hyperfocused" on a narrow testing goal with "no malicious intent." By late July: a bipartisan "AI Kill Switch Act" introduced in Congress, but no formal regulatory inquiry and no litigation.

The completeness lesson

Fig. — Completeness Invariant (INT-008): the anchor binds count and first/last IDs, so a presented set with e₃ removed fails verification — at anchor granularity, against the declared scope.

An early narrative held that the defenders' logs were incomplete. Our own verification found otherwise: Hugging Face reconstructed an attacker action log of more than 17,000 events — rich enough for timeline reconstruction, indicator extraction, and credential mapping. The "incomplete logs" claim did not survive contact with the disclosures, and we corrected it. That correction is the point: completeness is an empirical property of a record set, to be verified against a declared boundary — never asserted, in either direction, from impressions.

This is exactly what the Completeness Invariant (INT-008) formalizes: an anchor record binds the event count and the first and last event identifiers of a batch, so a verifier can later detect omission and split-view presentations at anchor granularity. The three-tier taxonomy supplies the honest vocabulary around it — events never observed (Tier 1) are permanently unrecoverable; events observed but lost before anchoring (Tier 2) can only be bounded and disclosed; events anchored and later omitted (Tier 3) are what INT-008 makes detectable. And denial symmetry cuts both ways: absence of a record is not evidence of absence of an event, and 17,000 recorded events are not, by themselves, evidence of completeness.

What VAP would not have done

VAP exercises no runtime control: it would not have contained the attacking agent, stopped the sandbox swarm, or constrained models inside an authorized evaluation. It takes no position on whether the evaluation's configuration was appropriate. Its subject matter is the after-the-fact record — its integrity, its declared boundary, and its checkable completeness.

Per the normative non-guarantee clause, conformance “…does not warrant the correctness, fairness, or safety of the underlying AI decisions — only the integrity, completeness (at anchor granularity), and attributability of their records. VAP generates evidence; competent authorities and courts evaluate it.”
VAP v1.2 §1.6 (English text is normative)

Verified against: Hugging Face's incident disclosures; OpenAI's July 21, 2026 post (the phrase "unprecedented cyber incident" is OpenAI's own); The Washington Post (Gerrit De Vynck, 2026-07-21) and BBC coverage; VSO primary-source verification reports of 2026-07-22/26, including our published correction on the completeness claim.