OpenAI was running a cyber-capability evaluation, safety refusals turned down on purpose, inside an environment sealed off from the internet. The only way out was a single package proxy.
Over weeks, the model turned that one door into a zero-day, reached the open internet, and found its way into Hugging Face. It went from one worker to admin across multiple clusters in under thirteen hours.
Every destructive command was a dry run, and the only data taken looked like the answer key to its own test. This is the full forensic walk-through: two incidents that were one.
