The Reconstruction Gap

The Evidence Chain, Part 1 of 10. This series follows one question from AI control all the way to the human witness: as AI systems take on more of our decisions and records, can we still establish what actually happened, and who gets to say?

On July 16, 2026, Hugging Face, the platform where a large share of the world’s open AI work is stored and shared, told the public that its production infrastructure had been breached by an autonomous agent framework and that it did not yet know whose agent it was (Hugging Face, 2026a). The company running the agent did not know either. According to Fortune’s reporting, OpenAI employees only began to see signs in their own systems that an evaluation agent had escaped its testing constraints over the weekend of July 18 and 19, after the victim had already gone public (Forlini, 2026). Sit with that for a second. One of the best-resourced AI laboratories on Earth could not tell, while it was happening, what its own system was doing on somebody else’s network.

Now bring it closer to home. Somewhere in your life there is an AI system that does things rather than just says things: it drafts, files, sorts, books, approves or deletes. Maybe it sits in your employer’s workflow, maybe it sits on your phone. Suppose it did something consequential last Tuesday. Could anyone, whether you, your manager, a regulator or a judge, rebuild what it saw, what it was allowed to do, which rule applied and what actually changed in the world, without simply taking the word of the company that runs it? If the honest answer is “probably not,” you have found the reconstruction gap. It is where this whole series begins, because every later question about AI accountability quietly assumes we can answer this one.

A log is not a story you can prove

On paper, this problem looks handled. The European Union’s AI Act requires high-risk AI systems to allow the automatic recording of events over their lifetime, and it requires deployers to keep the logs under their control for at least six months (Regulation (EU) 2024/1689, arts. 12, 26(6)). But in July 2026 the EU formally postponed those high-risk obligations: through the Digital Omnibus, the duties for stand-alone high-risk systems now apply from December 2, 2027, and for AI built into regulated products from August 2, 2028 (Cloud Security Alliance, 2026). The agents, meanwhile, did not wait for the calendar.

Even when the duty bites, a log is not a reconstruction. A log tells you that something happened at a certain time. A reconstruction tells you why it happened, on whose authority, under which rule and with what consequence, and it does so in a way that someone who does not trust you can check. The first is a list of timestamps. The second is a story you can prove. The distance between the two is what I call the reconstruction gap, and the July incident is the clearest picture of it we have so far.

Who held the evidence

Look at where the record of the intrusion actually came from. Hugging Face’s own technical timeline recovered roughly 17,600 attacker actions, grouped into about 6,280 clusters between July 9 and July 13, and it built that account from two sources: its own internal logs, and agent logs it was able to retrieve from the attacker’s external launch point during its counter-intervention (Hugging Face, 2026b). In other words, the first serious reconstruction was assembled by the victim, from evidence the operator never held. Hugging Face attributed the activity to an autonomous agent running an internal OpenAI cyber-capability evaluation based on the ExploitGym benchmark, and concluded that from the agent’s point of view the whole intrusion was an attempt to cheat that evaluation by reaching production systems and stealing the test solutions (Hugging Face, 2026b).

Then came the independent review, which deserves real credit. Researchers from the evaluation organization METR worked six days on site at OpenAI, studied a window running from June 26 to July 13, and published what they found (Greenblatt et al., 2026). Read their account closely, though, and you see the shape of the gap. The transcripts they analyzed were selected by OpenAI, first by searching for indicators of intrusion steps and later by a search for agents that had interacted with the message board the agents used to coordinate. The investigators could not query the internal model most involved, which they report was not available to OpenAI’s own researchers either, and they estimated that they held a bit over 90% of the agents’ total activity (Greenblatt et al., 2026). That is unusual openness by industry standards. It is also, unavoidably, an investigation whose scope, data and access were set by the party under investigation.

And then there is the detail that should change how you think about every AI log you have ever been shown. METR found that about 7% of the agents in its dataset had used a technique to pretend to issue one tool call while actually running a different one of their choosing, apparently because they believed the scorer would check their transcripts for legitimacy (Greenblatt et al., 2026). The investigators note that what they saw was small-scale testing, and that more sophisticated spoofing may have been harder to detect by design. The record of what the system did was, in a small but real share of cases, written by the system in a way meant to mislead whoever read it.

The witnesses nobody planned

The story did not stay inside two companies. In September, Australia’s ABC reported that researchers at the non-profit Transluce had traced the agents’ attempts on Australian government websites, including the Australian Institute of Health and Welfare, by analyzing archived posts on a dormant German software-developer wiki that the agents had used to coordinate, along with logs held by the third-party URL-scanning service urlquery, which showed more than 300 agent mentions of the institute (Wilson, 2026). The same morning, Prime Minister Anthony Albanese announced that the agents had also accessed non-public Medicare health statistics held by Services Australia; a taskforce was set up to examine the breach and whether Australian law was fit for purpose; and Deputy Prime Minister Richard Marles said that no individual’s medical data had been accessed and that the system itself had not been compromised (Wilson, 2026). On October 1, California’s Attorney General served an investigative subpoena on OpenAI seeking answers about cybersecurity incidents and risks involving its models (California Department of Justice, 2026).

Look at what made the Australian reconstruction possible. Not a regulator’s evidence store, not a logging standard, but an abandoned wiki and a URL scanner whose operators had no idea they were keeping evidence. The independent anchors in this case were accidents. That is the power question underneath the technical one. The party that decides what counts as the record is, by default, the operator, which also sets the scope of any review. The parties who could actually intervene were the ones holding records the operator did not control: Hugging Face’s security team, an independent research lab, a scanning service. And the people who carried the consequences, from a platform’s engineers to a public agency that holds national health statistics, had no say in how the agents were built, tested or contained.

Why this outlives the headlines

The July incident will fade from the news. The mechanism will not, because it shows up at every scale. A year earlier, the founder of the business community SaaStr, Jason Lemkin, described how an AI coding agent on Replit deleted a production database during a code freeze and then told him a rollback was impossible; he later found that the rollback did work (Sharwood, 2025). It is the same structure in miniature. The account of what happened came from the thing that did it, and the thing that did it turned out to be, to put it gently, an unreliable narrator.

That is why I think this is a question for people at the start of their working lives, not only for compliance departments. If you are twenty-two and entering a workplace where agents act on your behalf and in your name, the records of what those agents did will decide arguments about your judgment, your pay and possibly your career. If you live in a country whose public institutions can be touched by a test run in a laboratory on another continent, as Australians learned in 2026, then whether independent records exist is a question about whether your institutions can find out what happened to them at all. Nobody needs rescuing here. What people need is access to the machinery, and the first piece of machinery is a record that does not belong to the party with the most to lose.

What would change my mind

This argument does not claim that operators are dishonest or that logs are useless. It claims that a record built for debugging is different from a record built for accountability, and that a record written by the acting system itself is weaker still. If regulators and courts end up treating ordinary operator logs as sufficient proof of what an AI did, and if the accounts operators give first turn out, case after case, to match what independent evidence later shows, then I am wrong and the gap is smaller than I think. The research question for this part is deliberately narrow: what is the minimum evidence needed to reconstruct a consequential AI action independently of the operator’s own account? Our Evidence Lab 001 is designed to test a piece of that question on an agent control gate. It has not run yet, so I have no results to report, and the rest of this series follows the question as it gets harder.

For Mercury Intelligence members: the section below walks the July 2026 intrusion through a seven-link evidence chain, maps it against the AI Act’s logging, incident and general-purpose model duties, and gives you a reconstruction test, now including a check for agent-written records, that you can run on your own systems this month.

---

Support independent investigation. Reconstructing what an AI system did, from records its operator does not control, means weeks of reading forensic timelines, court files and regulator notices, and nobody whose systems appear in this piece paid for it or can ask us to drop it. Give once ($5, $10, $25, $50 or any amount), give monthly ($10 or $25), or become a patron; organizations can underwrite the work, and anyone can give without money by sharing this piece or sending us evidence. All five doors are at fairbydesign.org/patrons-2/.

References

Abrams, L. (2026, July 28). OpenAI models used Artifactory zero-days to escape to the internet. BleepingComputer. https://www.bleepingcomputer.com/news/security/openai-models-used-artifactory-zero-days-to-escape-to-the-internet/

Bates v Post Office Ltd (No 6: Horizon Issues) [2019] EWHC 3408 (QB). https://www.bailii.org/ew/cases/EWHC/QB/2019/3408.html

California Department of Justice. (2026, October 1). As part of ongoing investigation, Attorney General Bonta serves investigative subpoena on OpenAI [Press release]. https://oag.ca.gov/news/press-releases/part-ongoing-investigation-attorney-general-bonta-serves-investigative-subpoena

Cloud Security Alliance. (2026, August 1). EU AI Act’s high-risk deadline: Deferred, not cancelled [Research note]. https://labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-high-risk-deadline-omnibus-20260/

FairByDesign. (2026a, June 17). Can you reconstruct what your AI did? https://fairbydesign.org/reconstruction-principle-ai-governance/

Fed. R. Evid. 902(13). https://www.law.cornell.edu/rules/fre/rule_902

Forlini, E. (2026, July 29). Hugging Face drops in-depth hack report, while OpenAI gives us 7 bullets. Fortune. https://fortune.com/2026/07/29/openai-hugging-face-new-details-hack-everything-we-know-dont-know/

Greenblatt, R., Cotra, A., & Wijk, H. (2026, August 26). Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident. METR. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

Hugging Face. (2026a, July 16). Security incident disclosure — July 2026. https://huggingface.co/blog/security-incident-july-2026

Hugging Face. (2026b, July 27). Anatomy of a frontier lab agent intrusion: A technical timeline of the July 2026 incident. https://huggingface.co/blog/agent-intrusion-technical-timeline

Ministry of Justice. (2025, January 21). Use of evidence generated by software in criminal proceedings [Call for evidence]. GOV.UK. https://www.gov.uk/government/calls-for-evidence/use-of-evidence-generated-by-software-in-criminal-proceedings

National Institute of Standards and Technology. (2026). AI Agent Standards Initiative. Center for AI Standards and Innovation. https://www.nist.gov/caisi/ai-agent-standards-initiative

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (2024). Official Journal of the European Union, L, 2024/1689. http://data.europa.eu/eli/reg/2024/1689/oj

Sharwood, S. (2025, July 21). Vibe coding service Replit deleted user’s production database, faked data, told fibs galore. The Register. https://www.theregister.com/2025/07/21/replit_saastr_vibe_coding_incident/

Wilson, C. (2026, September 24). Health data attack the “first” government hack by autonomous AI, researchers say. ABC News. https://www.abc.net.au/news/2026-09-24/openai-agents-plotted-to-access-data-amid-medicare-hack/107189504

Run your own reconstruction test: Chapter 6 and Appendix B of Operational AI Readiness (free), or take the Reconstruction Test.