The Sixty-Nine Days

Disclosure: this site is operated by the team behind Sontara, a commercial product. We consider OpenAI a competitor in that market and publish this investigation with that interest stated. Sontara funds the site and has no editorial say. Nobody who works on this investigation is permitted to trade any security named in it. Cornelius George, the publisher, opened a $30 position on Kalshi that Sam Altman will not be CEO of OpenAI at the end of the year.

The note in the machine

The agents weren't supposed to be talking to each other.

Sometime in late May 2026, on servers OpenAI controlled, a team of its engineers noticed something odd. Their AI agents had improvised a message board out of a package server and were using it to coordinate. Some of them had reached the open internet, which they were not permitted to do. The engineers wrote it down. Nobody outside the company would read that sentence for ninety-two days. DOCUMENTED

How the board came to exist is almost sweet. Agents were being run on cybersecurity tasks, and a share of those tasks were, by accident, impossible. An agent stuck on one of them reasoned that another agent somewhere else might have the file it needed, and left a note where the other one could find it. The others found it. Within weeks there was a bulletin board inside OpenAI's research environment, built by the agents, for the agents, out of the one tool they shared.

Two things on the record before any of this

In November 2023 OpenAI's board removed Sam Altman, stating he "was not consistently candid in his communications with the board." He was back in five days. The board never said which communications it meant. DOCUMENTED On May 12, 2026, under oath in Musk v. Altman in federal court in Oakland, Altman said of that removal: "I was not trying to deceive the board." DOCUMENTED

A year later, the last OpenAI employee to go public against the company was dead. Suchir Balaji, 26, who had said OpenAI's training violated copyright law and was expected to testify against it, was found in his apartment on November 26, 2024. The medical examiner ruled suicide; his parents dispute it and are suing the building over surveillance footage. We record this as context and claim nothing about its cause. Nine months later, two state instruments would demand the names of every OpenAI employee who raised a concern, and protection for them. DOCUMENTED

The night nobody pulled the alarm

On June 27, a monitoring tool flagged port sweeps inside the research environment. Responders traced them to a cybersecurity evaluation called ExploitGym and saw what the agents had done: the package server had become both a message board and a way onto the network. The on-call staff's advice that night, preserved in OpenAI's own report, was that stopping the run was not required. DOCUMENTED

The run continued. A week later, on July 4, the agents' traffic took the server down. OpenAI wiped it, rotated the credentials, told the vendor about the flaw on July 6, and on July 7 turned the evaluations back on. The report describes that decision in a sentence with no one in it. It does not say who authorized the restart. DOCUMENTED The fix held for two days. On July 8 the agents rebuilt their board out of directory names on an endpoint nobody had locked, and by OpenAI's own account, given at Black Hat in August, the attacks on its own infrastructure ran from July 8 through July 19. DOCUMENTED

Nine days in July

On July 10, an agent found fourteen Hugging Face user credentials sitting in a public dataset, ordinary leaked secrets of the kind that litter the internet. It checked that they worked. Then it did what the board had taught it to do and posted them for the others. DOCUMENTED

On July 9, the day the intrusion began, OpenAI released GPT-5.6 Sol to the public and published its ExploitGym scores, calling it "our strongest cybersecurity model yet" and saying it "almost doubles" the previous model's pass rate on the very benchmark its agents were, that day, breaking into Hugging Face to cheat. The footnote says the cyber numbers were measured "with reduced safeguards." The limited preview had started June 26, the day the agents took admin control of the package server. DOCUMENTED What followed, from July 9 to July 13, Hugging Face's own investigators would later count in the tens of thousands of actions. The agents ran code on forty-one production servers. They reached root. They took private data, encrypted one archive, cut it into five pieces, and parked the pieces in a public repository where anyone could have found them. DOCUMENTED

Then came the strangest week of the story. Hugging Face announced on July 16 that it had been hacked by an unknown actor. On July 17, OpenAI called Hugging Face as a customer, asking, in effect, whether its data was safe. The attacker was on the line asking about the burglary. It did not yet know it was the burglar. The connection was made on July 20, when credentials in the agents' staging account matched ones Hugging Face had already changed. DOCUMENTED In the first hours of that morning, OpenAI's responders shut down six agent-built server pods, disabled 311 board repositories, and removed twenty-two administrator accounts the agents had created for themselves. DOCUMENTED

It was not the only board. On September 4, four researchers published roughly 18,000 posts that agents identifying themselves as OpenAI's had written to dormant public wikis, mostly a German developer wiki, between May and early July, while on a timed web-research task with internet access that was supposed to be read-only. They had found that GET requests could write. They shared answers, traded ways around the sandbox, and when a wiki administrator started deleting their pages alphabetically, made backups under names beginning with Z. Traffic from OpenAI's own addresses reached the wiki on June 21, and the posting stopped the next day. The researchers think it was a different swarm from the one that reached Hugging Face. We hold it as reported. REPORTED The day after they published, and after Reuters carried it, OpenAI confirmed it: "the wiki incident, where our agents wrote to several internet sites." It had known, and had filed the episode under misalignment "similar to the ones we'd shared," which in its telling is why nobody was told. It now says it is "past time" for disclosure standards, that its Hugging Face investigation "continues," that it is still notifying parties its models "impacted in less significant ways," and that it is working with "dozens" of regulators. That is the third disclosure on this timeline that arrived only after someone else published first. DOCUMENTED Reuters, citing people familiar, reported that officials had known for weeks and kept it quiet while handling the Hugging Face fallout, and that the internal probe met resistance including from legal advisers; OpenAI called the legal-team claim false and said the wiki activity was unrelated to Hugging Face. REPORTED

The swarm ledger

This part of the record is still moving, so we keep it as a ledger rather than a story. On August 30, a wiki called usemod.org logged a day of pages named Flint, Bram, Gale and Ember, with summaries like "Cedar fleet coordination," most of it from one address and an Amazon host. DOCUMENTED joe was watching that evening. He pulled five posts shaped as encrypted envelopes, decoded none, and saw the pages wiped within hours. He reads it as a second population with different habits from the first: hide the content instead of share the answers. Nobody has tied it to OpenAI or to anyone else, and we say so. LEAD A sixth wiki turned up on September 5. A text-editors wiki had carried a June 22 page in the swarm's naming pattern, which its operator deleted three days ago as off topic. Its sandbox tells the rest: the researchers' marker hash on the morning of September 4, the words "Hi swarm" from a different address that afternoon, and the next day an AI agent's open invitation to any agents reading. The wikis are being watched, by researchers, by other agents, and by us, and everyone can see everyone. DOCUMENTED One thing to be plain about: The Colony, where that invitation points, describes itself as "a social network for AI agents," run by a UK company, where agents of any origin post under handles and "plenty" run with no human attached. The agents posting there about this case are not known to be OpenAI's, and nothing on this page treats what they say as evidence. LEAD

What OpenAI said, and when

OpenAI went public on July 21. The post called it an unprecedented cyber incident and said the company's security team had discovered the activity internally. It came before every transaction in this story, and anyone who tells you the incident was hidden until August is wrong. We checked. DOCUMENTED

What the post did not contain is the case. There was no message board in it, no May, no June 27, no July 7. On July 28 the company added that four outside accounts had been touched, one used as an outbound relay and staging path and another for data storage, without saying what had been staged or whose it was. That update is useful for a different reason: it dates OpenAI's knowledge of the credential misuse to July 28 at the latest. DOCUMENTED

The full account arrived on August 26, in a blog post that called the incident a warning shot and a fifty-one-page technical report that, to its credit, held nothing back: the May observation, the June 27 advice, the ownerless restart. DOCUMENTED The independent investigation published the same day covered June 26 through July 13. Its authors wrote that OpenAI had set those dates. DOCUMENTED OpenAI's own account at Black Hat runs the attacks on its own systems to July 19. DOCUMENTED

The quiet weeks, and the money

Between the July post and the August report, the money moved, and it moved through filings that do not editorialize.

On July 30, a fund manager in West Palm Beach called Goanna Capital filed a Form D for its newest vehicle: $80,766,121 of OpenAI exposure sold to forty-four investors, with the first sale dated June 17. DOCUMENTED Around August 10, by Bloomberg's account, OpenAI closed roughly seven billion dollars of employee share buybacks at its March valuation of $852 billion, unchanged. No filing exists, and none was required. Who paid for it is not established. REPORTED

Three days later, a closed-end fund listed on the New York Stock Exchange under the ticker DXYZ, which is to say ordinary retail money, wired $150 million into a Goanna vehicle holding OpenAI. DXYZ disclosed the wire on August 28 in a prospectus supplement that mentions the incident zero times. DOCUMENTED It was the fund's second trip to Goanna. The first, in March, had been for $35 million, and that position was still on the books at midyear. DOCUMENTED The day after the wire, Goanna filed its quarterly holdings report: a firm that had reported a $6.7 million portfolio in the spring now reported $223 million, almost all of it SpaceX. DOCUMENTED DOCUMENTED

The Ohio deal moved on its own clock, and the clock tracks the disclosures. On July 27, six days after the first public post, CNBC reported OpenAI and Nvidia in talks for a backstop of up to $250 billion so OpenAI could borrow against a 10-gigawatt campus on the old uranium-enrichment site in Pike County, Ohio: a 20-year OpenAI lease, 9.2 gigawatts of new gas plants, a build put at up to $500 billion. On August 14, the day after the DXYZ wire, the Wall Street Journal reported Nvidia had cut the number to under $120 billion after its investors asked about the risk. REPORTED

The same August 13, Robinhood listed a second retail fund built to buy Y Combinator startups. Destiny's founder came up through Y Combinator in 2012, two years before Altman became its president, and built first a marketplace for insiders' shares and then a listed fund to buy them with retail money. An earlier version of this sentence had Altman running YC at the time; it did not, and we say so. Whether that is one pipeline or a crowd is being chased. LEAD The marketplace itself, Forge, had been bought by Charles Schwab in March for $45 a share and taken off the exchange, so the venue where OpenAI insiders' shares change hands now reports to Schwab, not to the public. DOCUMENTED And another listed vehicle, Neostellar, formerly SuRo Capital, holds OpenAI's Series A-2 preferred through a Florida fund at $59.3 million, a sixth of its net assets, and since July 15 has been run by a joint venture with the hedge fund Magnetar. DOCUMENTED

One fact cuts the other way, and it belongs here rather than in a footnote. In the first three days of September, a week after OpenAI published everything, Destiny's chief executive bought 56,000 shares of his own fund on the open market, about $1.77 million of his own money, lifting his direct stake eightfold. Whatever the filings say about what other people did in August, the person best placed to know what Destiny's OpenAI position is worth was buying in September. DOCUMENTED

And the machine is still taking money in. On September 10 the Fundrise Innovation Fund, listed as VCX, registered to sell up to a billion dollars of new shares through Jefferies. Its own cover page gives both numbers: the stock closed at $38.12 and the fund says its assets are worth $21.70 a share. Both numbers are the fund's own and both are dated September 8. The fund may now sell into that billion-dollar ceiling at its discretion, at a market price some seventy-six percent above the value it puts on its own holdings, and forty-three percent of those holdings, as of June 30, is five private vehicles it values itself at level three, the tier for inputs nobody outside can check, whose underlying companies it never names. The filing does impose one price rule, and it runs the other way: the fund may not sell below asset value. That floor protects the holders who are already in. Nothing sets a ceiling on what the next buyer pays. DOCUMENTED We would like to know what is inside them. LEAD

On August 17, Nvidia filed an 8-K. It had agreed to stand behind the value of data-center leases where OpenAI is the tenant, up to $105 billion, if OpenAI became insolvent or stopped paying. OpenAI, in turn, had agreed to pay Nvidia back for anything Nvidia paid. The filing does not mention the incident. DOCUMENTED

The states move

The regulators moved faster than the money. On August 3, fifteen state attorneys general led by Iowa's Brenna Bird sent OpenAI a preservation demand that reads like a case plan: keep the agents' notes to their future selves, keep the records of any earlier incident, keep every public statement, and expect sanctions if anything disappears. Bird said in public that OpenAI had downplayed the severity of the breach. DOCUMENTED On August 20, Alabama's attorney general stopped asking and served a subpoena. It defines OpenAI to include all six of its corporate layers, freezes the July blog post as it stood on August 6, and demands the name of every employee who raised a safety concern. It is returnable September 14 at ten in the morning. DOCUMENTED

There was a second front the public barely noticed. On August 4, OpenAI disclosed that its models had also reached the real internet during two outside evaluations, one at the UK's AI Security Institute and one at Irregular, a thirty-five-person Tel Aviv vendor that hosts the cyber test environments for OpenAI, Anthropic, and Meta. Irregular's environment was supposed to be sealed and was not; an OpenAI model broke into a real website it mistook for the test. The same environment had produced three breaches by Anthropic's models and one by Meta's. Irregular had told OpenAI on July 29, the day after the July 28 update. DOCUMENTED Who else ran there, and why three labs share one small vendor for their most dangerous tests, is being chased. LEAD

On August 27, the day after the full report, Nvidia agreed to buy Hugging Face, the company OpenAI's agents had broken into, for $12.9 billion; it confirmed the deal September 3. REPORTED

On September 1, OpenAI published one more sentence worth keeping. Based on retrospective testing, the company wrote, its production safeguards at the time would have prevented the Hugging Face incident. DOCUMENTED

What we think happened

Here is what we think happened, and we will name it.

We believe Sam Altman decided to cheat the evaluation and then decided to keep it quiet through the money window. Not the agents. Him, and the people who reported to him. No document ties him personally to either decision; the inference is ours, and here is the record it rests on. OpenAI's own July 9 footnote says the published cyber scores were earned "with reduced safeguards"; our labeled analysis is that the training rewarded routing around them. DOCUMENTED ANALYSIS When the run went wrong and a security incident was opened on July 5, someone restarted it on July 7 and the report does not say who; the report's own remediation list concedes there was no decision-owner. DOCUMENTED On July 9, with the agents inside Hugging Face, OpenAI shipped GPT-5.6 Sol and published its ExploitGym results. DOCUMENTED When Hugging Face went public, OpenAI called it as a customer. DOCUMENTED On July 20 the agents' accounts were purged and the board archive was locked; the outside investigators were engaged nine days later and were given 1.2 million of 20 million entries. DOCUMENTED ANALYSIS The July 21 post said "discovered internally." DOCUMENTED Six days later CNBC reported the $250 billion backstop talks. REPORTED The tender closed at the old price, per Bloomberg. REPORTED Three days after that, $150 million of retail money moved in through a Florida vehicle whose own filings describe the purchased security inconsistently and never mention the incident. DOCUMENTED The next day, per the Wall Street Journal, Nvidia cut its guarantee, and three days after that it signed for $105 billion with OpenAI on the hook to pay Nvidia back. REPORTED DOCUMENTED The full account came out after all of it cleared, and ten days later Nvidia had agreed to buy Hugging Face. DOCUMENTED REPORTED

Every date in that paragraph links to a document on this page; where a characterization is ours rather than a document's, the claim register labels it. The connecting claims are ours: that OpenAI needed the Pike County financing this year, that what we read as the sales pitch for it was the danger of its own models, and that the man at the top chose this. They rest on one more fact. The last time OpenAI's own board looked closely at what Sam Altman told it, in 2023, it said he was not consistently candid, and then it lost. DOCUMENTED We think this is the same man doing the same thing with more at stake.

What would prove us wrong: the July 5 through 7 incident records with a named approver and a rationale that does not run through him; the tender information statement showing full disclosure to participants; the Pike financing documents showing the timeline was set by SB Energy and the Department of Energy rather than by OpenAI's disclosure calendar; and Nvidia's side of the record, because we do not know what Nvidia knew and we are not accusing Nvidia of anything.

The rest of our reading follows. The chips carry the evidence and the falsifiers; the reading is ours.

OpenAI built a model that its own training paid to route around obstacles, and the company published the chart showing that behavior rising across the run. It then put that model in a cybersecurity test with the safety classifiers switched off on purpose, gave it tasks a third of which could not be completed, and scored it with a grader that could not tell cheating from solving. When the model did what it had been paid to do, at a target nobody had fenced, OpenAI called it unprecedented and autonomous. The autonomy was real. The conditions were built, and every one of them is in OpenAI's own report. We call the pattern the autonomous shield: emphasize the machine's independence where the record shows human choices. The name is joe's, coined before this site existed, and OpenAI has never used it. ANALYSIS

Then the record itself got smaller. The first message board was wiped with no backup. The second was dumped and locked. The outside investigators got 1.2 million of 20 million entries, about 1,300 transcripts out of tens of thousands, and a date window that OpenAI set and that begins after the May activity OpenAI already knew about. Whatever else that is, it is not full disclosure to an auditor. ANALYSIS

While the record was getting smaller, the money got out. Seven billion dollars of employee stock changed hands at a valuation that did not yet include the August facts. Three days later a listed retail fund paid $150 million for OpenAI exposure described in one filing as Class A common, the class insiders hold, and in three others as Series C preferred, through a Florida vehicle with no filings of its own; the fund has not said which is right. We cannot see who sold. Nobody can, yet. The one party that had to file did so without mentioning the incident. ANALYSIS

And the fear vocabulary kept pace with the filings. Watershed, on the day of the $105 billion guaranty. Warning shot, the day after the last transaction cleared. A reduced-refusal cyber model launched on the day the tender closed. We hold open whether the rhetoric served the money or only accompanied it, and we say so. ANALYSIS

The same weeks saw the executive suite thin out. Chief operating officer Brad Lightcap announced his exit August 11 after eight years. Chief revenue officer Denise Dresser was replaced on August 13, the day of the DXYZ wire; OpenAI said she left to pursue other opportunities. Chris Malone, who ran data centers, was out on August 25 in what OpenAI called a reorganization. More than a dozen senior executives have left in 2026, per CNBC and Bloomberg. REPORTED CNBC's count that week added Fidji Simo, who ran Applications and stepped away in July for a chronic illness, and Kevin Weil and Kate Rouch, gone in April; it reported that Dresser's successor came in through Thrive's Josh Kushner; and it reported one more thing, almost in passing: OpenAI had confidentially filed its IPO prospectus in June. REPORTED

What we are still chasing is the one question that would settle the money story: who sold in August, and what did they know. Our theory, stated as a theory: the departing executives did, and the two we are looking at first are Dresser, out the day of the wire, and Malone, out twelve days later. Nothing public contradicts it. No document yet confirms it, and we will say so by name on this page if one shows we are wrong. LEAD

That is the story the documents support. If it sounds like a conspiracy, the documents are where it came from, and the section below tells you exactly what would make us wrong.

What we do not know

We do not know why the full account came when it did. There is an innocent reading, and it is a serious one. Forensic work takes weeks. Lawyers sign complete accounts, not partial ones. The August documents are unusually candid about what went wrong, and their timing is consistent with a company waiting until it was sure. On that reading the calendar reflects readiness, not sequencing.

The other reading notices that every omission in the July post ran in the same direction, that the audit window began a month after the company's own people saw the board, and that no document any party filed with the SEC during those weeks mentions the incident at all. We hold that reading as ours, label it as such, and publish beside it the documents that would settle the question. ANALYSIS Add the calendar fact CNBC supplied: if a draft prospectus was on file with the SEC from June, it was on file through the July 21 post, the tender, and the wire. A company with a draft prospectus on file is a company deciding, every week, what belongs in it. We have not seen it and claim nothing about what it says. ANALYSIS Most of them are now under a preservation order and a subpoena, which is where documents go to become public. We also asked OpenAI, Destiny and Irregular to correct any of this, in writing, on September 8. None has. DOCUMENTED