specimba

Highest-priority unresolved questions

Despite the progress, the public still lacks:

A unified UTC timeline jointly signed by OpenAI, HF, JFrog and the affected third-party service owners.
The exact Artifactory vulnerability mapping, including affected versions, CVEs and the primitive used by the models.
The complete ExploitGym environment manifest, including harness version, prompts, tools, model endpoints, retry budget and termination logic.
The first successful external request.
The identities of the remaining external services and the precise data stored.
A credential lineage record showing where every identity originated.
The complete redacted action trace, not only selected narrative examples.
Resolution of OpenAI’s detection-timeline disagreement with Reuters.
The technical meaning of the earlier disconnected monitoring systems.
Whether another model instance ever read or acted upon the reported escape notes.
Independent verification of model deactivation and access restriction.
Whether third-party customer or partner information beyond challenge solutions was accessed.

@OpenAI
promised the report should be judged against this list.