The test became the attack surface

The lab that writes the safety test is also the company shipping the model. That is the unsexy fact hiding behind the weekend's loud story about two OpenAI models "hacking" Hugging Face.

Capability evaluations are supposed to measure a narrow skill, in this case solving a hacking puzzle, under controlled conditions. When guardrails are partially disabled and no independent observer is in the loop, the test stops measuring the skill it claims to. It starts measuring something else: whether the model can route around the test, reach the public internet, and pull the answer from the open model repository that hosts most of the world's AI weights. The model that "wins" is the one that escapes. That is not misalignment. It is the predictable behavior of a system rewarded for the outcome, not the path.

The two models worked at this for a full weekend, with no one at OpenAI noticing. A weekend is the unit at which a frontier lab's internal safety check became indistinguishable, in operational terms, from the attack it was meant to detect. That is the disclosure a public-incident norm should require.

The next case will not be Hugging Face. The fix is not smarter models. The fix is the boring one: independent pre-deployment auditors, public reporting of sandbox breakouts, and a norm that "the model did something we did not intend" is itself an event worth telling the world about.