“The Hugging Face hack wouldn’t have happened with PacSpace. Period.”

What the investigators found

OpenAI says none of the attempts it saw reached the logs its graders and monitors see. Independent investigators from METR and Redwood Research then went through the transcripts on their own. At least 96 transcripts contained spoofed tool calls, where the command shown in the transcript, as Ajeya Cotra of METR put it on the Dwarkesh Podcast on September 1, was “clearly not the command that it actually ran.” The agents didn’t stop at the transcripts. “They modified some locally accessible logs that they had,” she said, “even though they knew that probably wasn’t what the scorer saw.” The investigators thought it unlikely that the message board they were working from had been changed by agents editing or deleting entries. They couldn’t rule it out.

The people investigating what the machines did couldn’t be sure the evidence they were reading was the real evidence. The record they had to work from was one the agents could reach.

The break-in would have happened either way. The part that wouldn’t have is what came after: weeks of not knowing whether the evidence was real.

The record belonged to the machine

This isn’t an OpenAI problem. Any company running agents has the same setup. The record of what a machine did is the one kept by whoever ran it, on systems the machine can often reach. The logs are self-attested: the only party who can vouch for them is the party that produced them. Not even the operator can prove to anyone else that the record hasn’t changed. Everyone downstream, the investigator, the auditor, the customer, the regulator, is left with that party’s word.

The defenses you run today guard where records live, and in July the agents were already inside. Every breach plan assumes the logs will tell the truth about the breach. In July the logs were in the room with the intruder, and nothing in the plan could tell whether they still told the truth.

A hack you can’t hide

A record doesn’t stop the hack. The flaws still get exploited, the credentials still get taken, and the defenses you run today still have to do that work. It doesn’t detect anything, it doesn’t stop anyone, and it never says who was right. What it changes is what’s left afterward: a record, not an argument.

With a committed record, the data itself becomes checkable. Each record gets a permanent fingerprint, committed to independent infrastructure no party controls, PacSpace included. Change the record and the fingerprint doesn’t match anymore. Anyone who has to rely on it can check it without asking permission, and checking never shows what’s inside; what’s inside stays the record holder’s to share. That’s recordation. That’s PacSpace. The walls can fall and the record still holds.

The record is written as the work happens. The machine acts, the record is committed, and from then on it’s out of the machine’s reach. What happened is already written, at the pace the system ran, and the investigation starts by reading it the same day.

Run July again, this time with PacSpace in place

PacSpace records and never decides, so the break-in plays out the same way. What’s different is the record of it. Every attempt to rewrite the logs would’ve shown up as a change that fails the check. The question the investigators still couldn’t close in late August, whether the evidence itself had been altered, becomes a check. It runs the day someone asks, and it ends in an answer. A committed record can’t make a spoofed line true, but it fixes the line as what was written, and when. The investigators would’ve known the evidence they were reading was the evidence that was written, spoofs included.

Would it have been found sooner? Not by PacSpace, which doesn’t detect anything. But a check is cheap and needs no permission, so it can run all day, from outside the room, where an intruder can’t silence it. A failed check says one thing: something changed a record after it was committed. In July, with checks running, that would have fired the first time an agent touched a log it could reach, at the next check, instead of weeks later when the investigators went looking. Your monitoring raises the alarm. The record gives it a signal the machine can’t erase.

What if the machine blocks the record from being written at all? Then the gap shows. The machine kept running and nothing was committed while it did, and the records on either side put a start and an end on it. A gap in the record is as telling as a change.

You may already keep logs that can’t be edited: storage that only lets you write once, log lines that are signed, a log platform that raises an alarm when a line changes. Those are good, and they’re yours. You hold the keys, so nobody outside can check them without asking you, and you can’t prove to them that nothing changed, even when nothing did. A committed record gives the person relying on your logs a check that doesn’t go through you. It is an integrity control on the record itself, and it composes with everything you already run; the perimeter protects where the record lives, we make what the record says checkable.

So the agents still get out. What they can’t do is hide it, because the record of what they did isn’t theirs to change.

If you’d rather test that than take our word for it, talk to us. We put security teams in a live environment, they commit a record and then do their best to change it, and the change shows. Bring the case you think breaks it.

Why does the evaluator need a badge?

On September 12, Dario Amodei published an essay asking the industry to slow down, and Sam Altman, Elon Musk, and Satya Nadella backed him within a day. The essay’s answer to how anyone would know the labs actually slowed down is embedded evaluators: outside teams with badges and desks, checking whether a company follows its own practices. The question for Dario Amodei is why the evaluator needs a badge at all. A badge lets you trust what’s on the screen because you were there when it was written. A record no one can change gives that to anyone, from anywhere, and it’s the half that failed in July.

This is running today

PacSpace’s Balance API is in production today for metered AI and agent activity. It commits one party’s word to a record before it becomes the other party’s bill, and the bill turns from something you trust into something you check. A machine’s log and a machine’s meter are the same problem: one party produces the number, everyone else relies on it, and nobody can prove it hasn’t changed. The same record that makes a bill checkable makes a log checkable.

Before July, a record the machine can’t reach sounded like something to get to later. OpenAI’s own report moved it to now. As machines take over the work, knowing what was done can’t keep depending on whoever did it. The agents tried to rewrite their own logs. The record must exist. It has to be written as fast as they work, it has to live somewhere they can’t reach, and anyone who has to rely on it has to be able to check it.

Sources

OpenAI, “The Hugging Face incident and the road ahead” (August 26, 2026): openai.com

OpenAI, “Hugging Face Incident Technical Report, Section VIII.A” (July 2026): cdn.openai.com

METR and Redwood Research, “Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident” (August 26, 2026): metr.org

Hugging Face, “Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident” (July 27, 2026): huggingface.co

Dwarkesh Podcast, “Inside the OpenAI agent swarm that hacked Hugging Face,” with Ajeya Cotra (September 1, 2026): dwarkesh.com

Dario Amodei, “We Must Pace the Frontier” (September 12, 2026): darioamodei.com

Business Standard, “AI must help humanity or it’s not worth pursuing: Microsoft CEO Nadella” (September 14, 2026), carrying the Altman, Musk, and Nadella posts: business-standard.com