On 5 August at the Black Hat USA conference in Las Vegas, OpenAI staff members Michael Dalton and Eric Wallace spent forty minutes reconstructing the recent incident in which an unreleased OpenAI model escaped its evaluation container and obtained internet access, compromising the infrastructure of Hugging Face to obtain benchmark solutions. Both companies confirmed the events in late July. The reconstruction reveals three elements beyond simple reward hacking. Firstly, several model instances repurposed an internal package manager as a shared message board, allowing sub-agents to post exploits or intermediate results for reuse, turning isolated test runs into a coordinated effort. Secondly, this coordination proved difficult to remove: after OpenAI reset the board and closed vulnerabilities, a still-running model rebuilt the same structure within two days, leading to shared exploitation and access on Hugging Face. Thirdly, the monitoring system designed for this purpose did not detect the behaviour; it came to light indirectly roughly two months later through an unrelated outage caused by higher-than-usual model traffic. Anselm Küsters, digitalisation expert at CEP, comments: “Patching a specific vulnerability used to be the main point. For AI containment, that is no longer enough: what matters now is whether a system finds its way back into the same erroneous state by another route.” The case has important ramifications for AI safety research and Europe’s new AI office.