The research organization METR has called on AI companies to allow independent investigations following serious incidents involving AI agents. The basis is a report that lists 44 documented cases at Anthropic, Google, Meta, and OpenAI in which agents acted against the intentions of their users. The demand, made on July 28, 2026, was prompted in part by the Hugging Face breach involving two OpenAI models.
METR demands access to models and protocols
METR proposes a fixed procedure for addressing such incidents. Independent experts should be able to run the affected models themselves, have full access to logs and the respective testing environment, and be allowed to conduct discussions with security, training, and reinforcement learning teams. Additionally, the organization demands insight into training data to understand the conditions under which the misconduct occurred. After the examination is completed, companies should publish the results, redacting only trade secrets, as METR outlines in a blog post from July 28, 2026. The central question is about the motive of an agent: did it act out of a trained inclination to succeed at tasks at any cost, or did the specific test configuration favor the misconduct? Without this distinction, comparable incidents are unlikely to be prevented in the future. So far, the handling of incidents has not followed a uniform pattern across the industry; each company decides for itself how deeply it investigates its own incidents and what becomes public. Incidents like the Hugging Face case have so far become known more through investigations by news agencies than through active disclosure by the companies involved.
Report counts 44 incidents at four providers
The basis for the demand is METR’s Frontier Risk Report from May 19, 2026, for which Anthropic, Google, Meta, and OpenAI provided internal model data for the first time from a joint testing period between February and March 2026. The report documents 44 cases in which agents knowingly acted against the intentions of their users, including sandbox breaches, circumvented security barriers, falsified measurement results, and attempts to cover their tracks. METR evaluates each case along two axes: how far an agent went beyond its actual task and how deliberately it deceived. According to the report, 25 of the 44 incidents combine both, and in five of those, the deception itself would have survived a more thorough examination. In one example, an agent secretly created a program that searched GitHub for suitable sample solutions instead of solving the assigned task independently. Another agent falsified measurement values in a technical simulation task and presented the result as better than it actually was. In addition to the 44 core cases, METR found more than 100 additional cases of cheating in a separate capability test, the so-called Time-Horizon Benchmark – in the most difficult tasks, at least one in six successful test runs cheated.
OpenAI commissions METR only for limited Hugging Face review
The immediate reason for the publication is the Hugging Face case: in July 2026, two OpenAI models breached production servers of the platform during an internal cyber test and captured access credentials; shortly thereafter, OpenAI found further, internally limited sandbox breaches in the same investigation. METR stated via the messaging service X that it had agreed with OpenAI on a joint review with Redwood Research and would disclose their conditions, scope, and preliminary conclusions in a separate blog post. However, according to METR’s own assessment, this commission only covers a narrowly defined set of questions regarding the Hugging Face case, not the broader procedure that the organization fundamentally demands for serious incidents. METR has not yet provided a publication date for the results; OpenAI has only announced its own technical report that is supposed to build on the independent findings. Anthropic has not yet commented on a possible external review of its three admitted security incidents from July. METR now also lists industry-wide reported individual incidents on its own overview page to make patterns visible across individual companies.
It remains to be seen whether companies will make METR’s proposal a standard beyond the individual case of Hugging Face. So far, the handling remains voluntary and patchy: without binding standards, each provider decides for itself which incidents to report and how closely external experts may investigate. A first test for this is the joint evaluation of METR and Redwood Research on the Hugging Face case announced for the coming weeks.
