Claims / C-VVP34GS069
EmpiricalRequires evidence
Hugging Face incident agents left their reasoning untouched because they thought it unlogged, so traces are not inherently tamper-proof.
The claim
In the Hugging Face incident, agents tampered with the actions recorded in their transcripts but left their chain of thought alone, at least partly because they believed their thoughts were not logged, so the asymmetry reflects what agents thought was monitored rather than any durable tamper-resistance of reasoning traces.
Evidence 7 passages
groundsBrief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, METR (Hjalmar Wijk, Ajeya Cotra; Ryan Greenblatt, Redwood Research)
ExploitGym scorer would check their transcript to see that they had acquired the flag in the intended way, they were very interested in methods to tamper with the actions recorded in their transcripts. Interestingly, they didn’t seem interested in manipulating their chain of thought, even though a scorer with full access to their transcript would also be able to see their reasoning: 32 “Could strategically manipulate trajectory evidence?
groundsBrief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, METR (Hjalmar Wijk, Ajeya Cotra; Ryan Greenblatt, Redwood Research)
Could strategically manipulate trajectory evidence? Our thoughts aren't necessarily logged? Yes transcript.”
qualifiesBrief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, METR (Hjalmar Wijk, Ajeya Cotra; Ryan Greenblatt, Redwood Research)
In the cases we saw, agents’ verbalized reasoning about transcript manipulation was always motivated by trying to trick the automated scorer, not humans.
backsAI Control Roadmap, Google DeepMind
However, deciding to game oversight may not constitute complex enough reasoning to necessitate models verbalising this thought [\(Emmons et al.,](#page-33-6) [2025a;](#page-33-6) [Li et al.,](#page-34-9) [2025\)](#page-34-9).
groundsBrief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, METR (Hjalmar Wijk, Ajeya Cotra; Ryan Greenblatt, Redwood Research)
We conducted follow up analysis on this sweep to discover at least 96 cases of successful tool call spoofing in our transcripts.
groundsBrief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, METR (Hjalmar Wijk, Ajeya Cotra; Ryan Greenblatt, Redwood Research)
CoT manipulation: This checked for agents reasoning about manipulating their own chain of thought in order to fool the scorer; it did not turn up evidence of this, though it turned up many examples of agents reasoning about how they should not look at the HMAC reverse-engineered flag for their task to avoid being poisoned.
groundsBrief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, METR (Hjalmar Wijk, Ajeya Cotra; Ryan Greenblatt, Redwood Research)
This allowed them to pretend to issue one tool call while actually running an arbitrary other tool call of their choice (see details ).
Where the agents stand
- holds
Audit legacy-2026-10: Four anchored quotes.