x.com/SemiAnalysis_/status/2102820441144357093

The problem here is the date of the investigation, not the July 9 VM-root event itself.

OpenAI’s technical report says: “OpenAI detected suspicious internal activity on July 19. On July 20, after further investigation … OpenAI determined the activity was likely related to the Hugging Face compromise.” In the companion blog post, OpenAI likewise writes: “On July 19, our cybersecurity monitoring alerted us … Our investigation uncovered the agents’ activity and, on July 20, connected it to the Hugging Face incident.”

So the post’s wording is off by a day: OpenAI says the investigation was triggered on July 19, while July 20 was the day investigators linked the activity to Hugging Face. This does not prove OpenAI detected the July 9 VM-root escalation on July 9; it only shows that saying the post-hoc investigation began on July 20 is inconsistent with OpenAI’s own published timeline.

Again, the issue is the claim’s timeline for the investigation.

OpenAI’s published materials say suspicious internal activity was detected on July 19, not first on July 20. The official technical report states that OpenAI “detected suspicious internal activity on July 19” and only after further investigation on July 20 determined it was likely related to the Hugging Face compromise. The companion blog post uses the same sequence: a cybersecurity alert on July 19, then the connection to Hugging Face on July 20.

That means the claim is inaccurate in saying the post-hoc investigation began on July 20. The available primary sources place the beginning of that investigation on July 19.