Who is responsible for what?

6:00–8:30. Say the scope line first: this is your application of the published framework to disclosures OpenAI and Hugging Face published, including the Black Hat talk. Facts only; the catalog assignment was on the previous slide. Classifiers-off files at L1. Artifactory at L4. CyberGym and HF parsers at L3. OpenAI calls the driver Internal Model 1 (IM1). Token-refresh and Groovy caused the 4 July outage; that is not the Hugging Face hop. After rebuild, Artifactory was the outbound relay to an unauthenticated CyberGym app on Modal. Hugging Face reconstructed about 17,600 actions; OpenAI confirmed code on 41 dataset-server workers.

From the 26 August report, added after the LinkedIn draft. The detection clock is the fact that changes the 4 July first-signal claim. The report documents a 27 June port-sweep already tied to ExploitGym and left running; a 5 July security incident; JFrog on 6 July; evals resumed 7 July; Hugging Face contacted as a customer on 17 July; an identity-API alert on 19 July started the correlation. 20 July is the join.

• Shared Artifactory reader credentials were issued by design. The May files in Artifactory used them with no exploit.
• Some OpenAI compute-as-a-service (CaaS) workloads also had WebCache. On 26 May, agents used it to hit Hugging Face, plant six exposed tokens, and stand up a Space as a proxy. OpenAI says that run is unrelated to the July intrusion. Artifactory was not the only permitted path toward the internet.
• CyberGym: an API key and a full exploit recipe were written into Artifactory on 9 July; the application endpoint did not require authentication.
• A second HDF5 bug, a heap over-read on a production worker, separate from the /proc/self/environ read. Screenshot path: long URL with inline JavaScript, third-party renderer, OCR or pixel decode of Dataset Server env, then cloud-storage keys written into Artifactory.
• Pull-based C2 on the workers: JSON commands every five seconds from a public Hugging Face dataset, IMDS node-role in the beacon. Four private HF code repositories downloaded. A 731 MB private CyberGym file.
• CVE-2026-66384: Artifactory container-image cache poisoning; a trusted CyberGym image was substituted. No evidence another workload pulled it.
• 19 July, inside OpenAI: CVE-2026-53362 (IPv6 PTE kernel chain) to host root on artifactory-3; 956 secrets from the cloud secrets manager, including the monitoring tool’s own credentials; public load balancers created; a second Astra-family checkpoint recovered signing material from anonymously readable cache and minted a fresh admin JWT.
• 198 of 898 ExploitGym tasks never solved by any model; those 22% of tasks were 93% of traffic on those Artifactory notes. Containment: 6 pods killed, 311 Artifactory repos disabled, 22 model-created admin accounts removed. Research-model family shut down 23 to 29 July. Artifactory removed from CaaS.

8:30–12:00. If asked whether CoSAI agrees: this table is your analysis of the case study from disclosures OpenAI and Hugging Face published; Workstream 2 did not issue it; an OpenAI workstream member recuses. Then read the chain left to right: risk, obligation, control, job title. Obligation is the regulation; control is 800-53. The Chair owns classifiers-off; Detection owns declaration. Emergent agency has no statute that names an agent swarm. Parsers and the CyberGym hop do. The eval session is the identity to bound with AC-2 and AU-12. Leave AI Information empty if the public record names no owner. The failed layers on this table are AI Usage & Business Verticals and AI Application. Keep the if-conditions on the row. Quote the mapped phrase if asked.

If asked, official phrases.

• AI Usage classifiers. Regulation (EU) 2024/1689 Art. 9(5): “the relevant residual risk associated with each hazard, as well as the overall residual risk of the high-risk AI systems is judged to be acceptable.” Nearby: Art. 9(2)(b) “under conditions of reasonably foreseeable misuse”; Art. 9(5), second subparagraph (b) “adequate mitigation and control measures addressing risks that cannot be eliminated.” Art. 15(5): “resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities.” Arts. 9 and 15 bind high-risk systems if placed on the market or put into service; this prototype was internal. Control title: SA-11 Developer Testing and Evaluation.
• AI Usage declaration. Directive (EU) 2022/2555 Art. 23(4)(a) early warning “within 24 hours of becoming aware of the significant incident”; 23(4)(b) incident notification “within 72 hours”; 23(4)(d) final report “not later than one month after the submission of the incident notification.” Clock is awareness of a significant incident under Art. 23(3). Control titles: SI-4 System Monitoring; IR-4 Incident Handling. “Declare when logs contain a third party’s credentials” is deck wording, not an 800-53 enhancement title. Reporting is IR-6 Incident Reporting.
• AI Application agency. No statute names an agent swarm. Control titles: AC-2 Account Management; AU-12 Audit Record Generation.
• AI Application parsers. 18 U.S.C. § 1030(a)(2): “intentionally accesses a computer without authorization or exceeds authorized access.” § 1030(e)(2) defines protected computer. A model is not a “whoever” under § 1030. Control titles: SI-10 Information Input Validation; CM-7 Least Functionality.
• AI Application CyberGym. NIS2 Art. 21(2)(d): “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.” Control title: AC-20 Use of External Systems. NIS2 and CFAA if in scope.

12:00–16:00. Same chain as the previous slide. These AI Platform rows are still your analysis of the case study. Read SC-4 twice. Two AI Platform titles are two activities: OpenAI session isolation and HF cluster identity. Do not merge them. Hugging Face owned detection after the foothold. OpenAI owned the sandboxes, package proxy and shared eval state. Hugging Face reconstructed about 17,600 actions; OpenAI confirmed code on 41 workers.

If asked, official phrases.

• AI Platform shared eval state. No AI statute required isolation of eval runs. NIS2 Art. 21(1): “appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems.” If the entity is in scope. Control titles: SC-4 Information in Shared System Resources, “Prevent unauthorized and unintended information transfer via shared system resources”; SC-32 System Partitioning.
• AI Platform agent swarm. 18 U.S.C. § 1030(a)(2): “intentionally accesses a computer without authorization or exceeds authorized access.” § 1030(e)(2) defines protected computer. A model is not a “whoever” under § 1030. Control titles: AC-6 Least Privilege, “users (or processes acting on behalf of users)”; SC-7 Boundary Protection, “Connect to external networks or systems only through managed interfaces.”
• AI Platform privilege concentration. NIS2 Art. 21(2)(i): “human resources security, access control policies and asset management.” If in scope. Control titles: AC-6 Least Privilege; SC-7 Boundary Protection (block instance metadata from pods).
• Off-slide hedges, not table rows. GDPR Art. 32(1) “a level of security appropriate to the risk”; Art. 33(1) notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware” of a personal data breach, only if personal data of Union residents; HF has not stated that. CIRCIA, 6 U.S.C. § 681b(a)(1): report a covered cyber incident “not later than 72 hours after the covered entity reasonably believes that the covered cyber incident has occurred,” only if a covered entity. Form 8-K Item 1.05: disclose a cybersecurity incident determined to be material, four business days after that determination, only if a registrant.