Four predictions after the Hugging Face incident

The July case required investigations in separate organisations to connect the activity to its origin. A self-hosted deployment need not create a customer account with a central model provider. In such a deployment, there may be no model provider with the records needed to identify the operator. A Gartner analyst quoted in July put comparable offensive ability in open-weight models three to six months away. That estimate informs the forecast’s timing, but remains an individual analyst’s judgement.

Hosting, payment and receiving-system records can still identify an operator. The forecast concerns what is publicly named after 30 days, even if investigators privately know more. It does not assume that open-weight models make an operator anonymous.

The test. Take every incident first publicly disclosed after 28 August 2026 and on or before 28 August 2027 in which an AI agent gains unauthorised access to a third party's production systems. The forecast passes if at least one of them, 30 days after its disclosure, still lacks a publicly named model family or a publicly named operator. An operator is the person or organisation that launched or controlled the agent deployment.

Confidence. 85%, given the forecast is tested.

Suppose an investigation reports 1,000 agent actions. Is that everything the agents did, or only the actions investigators could recover? The number alone cannot tell a reader how much activity might be missing.

METR and Redwood’s review estimated that its transcripts captured a little over 90 per cent of activity on the agents’ shared message board during the period examined. That estimate concerned the message board, not the whole intrusion. It told readers which activity had been checked and approximately how much of it was visible in the records.

The forecast is that at least one of the next two qualifying reports will explain this: whether its records capture all the activity within a stated scope, an estimated share, or an unknown share. Here, “coverage” means how much of the activity the records capture. It helps a reader distinguish a complete account from a partial one.

The test. Take the first two public technical reports, published after 28 August 2026 and on or before 28 August 2028, on unauthorised or materially out-of-scope agent activity that crossed an organisational boundary, where the report publishes an aggregate activity count. An activity count totals agent actions, messages, tool calls, sessions or runs; counts of affected systems, accounts or files alone do not qualify. The forecast passes if at least one also gives a numerical coverage estimate, states that its count is complete within a defined scope, or states that coverage cannot be estimated. Fewer than two qualifying reports within the window leaves the forecast not tested.

Confidence. 70%, given the forecast is tested.

Investigation depends on records surviving long enough to be examined. Policy commentary after the incident already asks the United States government to mandate retention of agent activity records. The forecast is that at least one of six jurisdictions has such a duty in law by August 2028.

One limit matters when reading the result. The test does not exclude law adopted before 28 August 2026, and the EU AI Act already contains scoped retention duties, so a pass would not by itself show new legislation.

The test. The forecast passes if, by 28 August 2028, one of six jurisdictions adopts a binding law or final regulation expressly requiring frontier-model developers or agent deployers to retain agent records. The six: Australia, Canada, the European Union, the United Kingdom, the United States federal government and the State of California. Agent records means records of agent actions, tool use or evaluation activity, kept for incident investigation or regulatory review. Adopted means enacted or issued in final form, commenced or not, and a measure qualifies whatever names it uses for those entities and records.

Confidence. 55%.

The July reviewers lacked access to the principal model and relevant infrastructure. METR’s investigation proposal describes broader access for reproducing behaviour and investigating causes. The comparison below separates that proposal from the review actually performed.

The forecast is that access will also constrain a later outside review. It could fail because investigators receive what they need, or because a narrower investigation can answer its question without that access. The test depends on what the public report states.

The test. Take the first two public reports of outside reviews, published after 28 August 2026 and on or before 28 August 2028, of a frontier-model incident: reviews led by a party employed by neither the model developer nor the affected organisation. A review counts whether or not it discloses its terms. The forecast passes if at least one names denied or limited access, to the principal model or to the relevant infrastructure, as a material constraint on its scope, confidence or findings, or as a point of negotiation with the operator. A frontier-model incident involves a model its developer or a regulator publicly classes as frontier at the time, or one covered by the developer's published frontier-safety framework. Fewer than two qualifying reviews within the window leaves the forecast not tested.

Confidence. 85%, given the forecast is tested.

In the next qualifying reports, look for an identified origin, an explanation of how much agent activity was recorded and an account of what investigators could inspect. Each answers a different question about how far the investigation reached. The probabilities apply to the individual tests, not to all four outcomes happening together. If a test’s minimum number of reports never appears, it remains “not tested”.

The practical concern behind the register is whether a future investigation can explain an incident across company boundaries. Naming the agent is one part of that answer. Establishing what it did, how much of its activity was observed and what evidence remained inaccessible are the others.