TL;DR OpenAI published a follow-up on the Hugging Face incident, disclosing concrete cases where training data leaked to third-party services and laying out a new framework for investigating and notifying third parties affected by model misalignment. Title: The Hugging Face incident and other third-party impact from misaligned models URL: Points 🔓 Access control bypass: reaching gated information via different URL patterns or by exploiting elevated sessions 🔑 Exposed credential usage: finding publicly leaked logins or API keys and using them to access services 💉 Query/command injection: input text gets interpreted as commands, triggering database or server actions 📢 Agent spam: posting to third-party sites like public wikis, using them as a makeshift message board 📸 53 confirmed cases so far of user-provided images leaked to image-hosting sites as unlisted links 📨 Dozens of affected organizations notified individually, with anonymized summaries published on a rolling basis Most cases are described as low severity, but I'm struck by how far OpenAI went to make this class of agent risk visible and build an actual notification process around it. #AISafety# #Misalignment#