Fifty petabytes of records under review

OpenAI has set out how the review it began after the Hugging Face incident actually works. The company says it is one month in and has not yet found another compromise of a third party comparable in scale or severity to that one, while expecting more cases to surface as it works backwards through historical records. As of 26 September it had notified more than 100 organisations, and it stresses that a notification does not by itself mean private information was accessed or a system was compromised.

The numbers give a sense of why this takes months. The search covers roughly 50 petabytes of records, a volume that follows from training runs across tens of thousands of GPUs. The company illustrates the scale by noting that one person reading it as plain English at 240 words a minute, without sleeping, would need about 66 million years. Around 7,000 GB200 and GB300 GPUs are dedicated to the review, at a cost OpenAI puts at over half a million dollars a day.

Four passes, then people

The pipeline narrows deliberately. A broad search pulls records where models changed websites or handled passwords, API keys and other credentials. A first AI pass with low test-time compute reads those records, including the models' recorded chains of thought, and flags anything worth a closer look, including actions a model considered but did not take. A second pass spends more compute separating harmless activity from behaviour that needs attention and rating severity. A third spends more again, grouping behaviour by type and looking for patterns across multiple agents on the same domain, before human investigators see what is left.

OpenAI is also writing down when it will tell anyone. Its current security standard is to notify when its models bypass an organisation's security controls without authorisation or impair the availability of a service, and it says it errs towards notifying even when it is unclear whether the information reached was meant to be public. A separate private-notice standard for misaligned agent activity that harms a third-party site is still being developed, and the company says it intends these practices to be adoptable by the wider industry.