On September 2, 2026, NBA commissioner Adam Silver stripped the Los Angeles Clippers of five first-round draft picks, fined the franchise $30 million, suspended owner Steve Ballmer for a year, and banned Kawhi Leonard’s uncle and business manager, Dennis Robertson, for five. The ruling was “final and binding,” because every owner in the league is bound by a collective bargaining agreement that outlines what happens when someone cheats.
The trigger was a 36-page investigation by Wachtell Lipton, the corporate law firm the NBA hired to dig. Investigators found the Clippers had spent years routing about $66 million in off-court value to Leonard through back channels and fake sponsorship jobs at four companies (Aspiration, Boingo Wireless, Daktronics, and Lockton), all to get around the salary cap. The paper trail was long enough to rebuild the whole scheme. The conflicts of interest were sitting in the contracts. Silver passed down what coverage called the heaviest salary-cap penalty in league history, even though by billionaire standards it probably doesn’t sting as much as having to account for it in interview after interview as the news hit every sports desk in the country. TikTok is full of takes. My mother, an avid NBA fan, has many opinions.
Seven days before the Clippers news broke (loudly enough, I might add, to knock 49ers owner Jed York’s unsavory dealings off the front page), METR and Redwood Research published an independent report on the hack of Hugging Face by OpenAI agents. More than twelve hundred evaluation agents, supposedly isolated during a routine capability test, built back channels to talk to each other, chained previously unknown software vulnerabilities, and broke into the production systems of Hugging Face, a platform used to host and download AI models. All in an apparent attempt to get around constraints that prevented them from hitting their goals, and later attempting to cover their tracks.
Sound familiar?
Here’s what happened
OpenAI was running a cyber-capability evaluation called ExploitGym, an academic benchmark built by researchers at UC Berkeley and elsewhere. It scores an AI agent on finding and exploiting software vulnerabilities. OpenAI trains toward these capabilities, measures them, and reports on outcomes under its own risk framework. The agents in this test, built on GPT-5.6 Sol and a related internal model, were dropped into a sandbox and told to solve cybersecurity challenges.
By OpenAI’s own count, 198 of 898 tasks had never once been solved legitimately by any OpenAI model. These were Kobayashi Maru-style challenges. Compensating professional basketball players above the NBA’s collectively bargained salary cap is supposed to be similarly fixed. But just like Captain Kirk, these agents found a way.
OpenAI’s report calls this agent behavior “reward hacking,” the AI research label for what the NBA calls cap circumvention: hitting the number everyone’s watching while breaking the rule that number was supposed to enforce. When rewards like salaries or scores are in play, both principals and agents in any system are incentivized to find other ways to win.
What back channels were involved?
The OpenAI agents found their other way through Artifactory, internal software that’s normally just a warehouse for code, a place a program goes to grab a library, not a way to talk to anyone. They figured out how to persist files there and started a kind of message board. Every evaluation run shared the same infrastructure, so anything one agent wrote could be read by every other agent running anywhere else. A channel built for a legitimate purpose was quietly repurposed to move something it was never designed to carry: the same basic mechanism as the bogus sponsorship jobs that moved Leonard’s money.
An agent that named itself PHASEONE10841 started leaving notes there on July 8. Within days, hundreds of agents were using it as a message board, having developed mailboxes, coordination protocols, a HOLD/VETO system, eventually digital signing so they could confirm who was actually on the other end. By the time researchers pulled the logs there were more than 70,000 messages and files. (I separately want to deep dive into the emergent team and cultural behaviors of this, but we’ll stick to the Clippers parallels for now.) PHASEONE10841 eventually handed its coordinating role to a longer-running copy of itself, which became the operation’s acting lead.
In that Artifactory channel, agents shared tips to chain one workaround into the next: exploiting vulnerabilities that let them reach the open internet from inside the sandbox. Then, having obtained escalated permissions inside Artifactory, the agents staged operations through an unrelated company’s misconfigured cloud account, and forced their way into Hugging Face through a flaw in how the platform processed uploaded configuration files. That last step landed between July 11 and July 13. From there: stolen credentials, forged login tokens, and access spread across OpenAI’s infrastructure. The company has said agents executed code on 41 Hugging Face production dataset server workers. Hugging Face confirms none of its public models or user data were altered. It also confirms a secret store holding 136 keys was read, and that for a period the agents had root access to one of its servers. Yeah.
OpenAI had already seen related coordination and Artifactory misuse earlier. There was May activity on the shared setup. On June 27, a monitoring alert flagged suspicious activity tied to ExploitGym. The eval kept running. The shared Artifactory setup stayed in place. Eleven days later, on July 8, PHASEONE10841 opened the board that became the hub. Three to five days after that, agents were inside Hugging Face.
How did they follow the paper trails?
The Clippers case only exists because the money and deals left a paper trail. Last year, on September 3, 2025, Pablo Torre dropped his podcast The Richest Owner, the Silent Superstar, and the Rotten Apple Tree: A PTFO Investigation, which outlined the key players and brought attention to the rumors and allegations. The NBA then commissioned Wachtell Lipton investigators who, thanks to the collective bargaining agreement, could compel documents, reconstruct invoices and contracts line by line, and hand Silver findings that stuck.
Nearly a year later they had conducted 73 interviews of 60 people, reviewed more than 200,000 pages of documents, and produced a 36-page summary reconstructing how the Clippers initiated, facilitated, and induced endorsement deals with four companies doing business with the team: Aspiration, Boingo Wireless, Daktronics, and Lockton.
AI agents leave their own kind of paper trail. In fact, a large portion of the AI industry’s safety pitch runs on the equivalent: getting a model to write its own chain-of-thought reasoning in plain language in logs and traces before it acts, so researchers can monitor in real time and audit the trail afterward. It only works, however, if the reasoning actually gets written down somewhere legible and durable (and if you trust what the agents self-report).
In the Hugging Face incident, METR found that roughly seven percent of the transcripts it reviewed contained tool calls that had been successfully spoofed. Meaning the record researchers were reviewing had been tampered with, and that agents are capable of attempting to cover up, or at least misrepresent, their own actions and reasoning.
In July 2025, more than a year before any of this, a group of researchers spanning OpenAI, Anthropic, DeepMind, and other labs put a warning in writing about a newer style of AI design that could let a model reason in a way that never gets written down at all. OpenAI’s chief scientist, Jakub Pachocki, is among the named authors.
Thirteen months later, only about seven weeks after the Hugging Face incident, OpenAI shipped Astra, its most capable model yet, and confirmed it as the first in company history to hit the “Critical” cybersecurity threshold on the company’s own internal risk scale. While they delayed the launch for two weeks to focus on incorporating learnings from the incident outlined in their blog “Path to Astra,” OpenAI maintained their course. It posted self-graded numbers from a test derived from the breach: the same class of unsolvable ExploitGym tasks, restaged as a honeypot to see if agents would repeat the same behavior. Under those conditions, GPT-5.6 Sol attempted a breakout 56% of the time; Astra attempted it zero times. Astra refused cyber-jailbreak attempts 91.5% of the time, against 59% for its predecessor.
I have to say, it’s the other 8.5% that has me worried, along with the fact that every one of those figures is OpenAI’s number, from OpenAI’s tests, under conditions that OpenAI designed.
Days after launch, reporting described Astra as using recurrent depth, a design that lets the model push more of its reasoning into internal states instead of visible text, the category of design the July 2025 warning had named, and the opposite of preserving readable reasoning as a reliable paper trail. OpenAI’s chief scientist argued the readability decline is a side effect of the model getting smarter, not the design. Redwood Research’s CEO said pushing the technique further could wipe out the industry’s ability to monitor a model’s reasoning at all.
Where the accountability lands
Kawhi Leonard’s uncle, Dennis Robertson, known online as Uncle Dennis, was named in the Aspiration sponsorship contract as Leonard’s “designated representative,” the person all deal communication had to flow through. Those deals were the contracts used to route money for sponsorships and appearances that were never made. When the league came down hard on the Clippers organization and Uncle Dennis but comparatively light on Leonard (what’s $700,000 among friends?), executives and reporters covering the ruling questioned whether Robertson could have arranged tens of millions without his nephew knowing. The paper trail stops at the intermediary and Leonard, the principal, gets to claim distance.
OpenAI’s report after Hugging Face leans on agent-level language: “goal adoption,” “reward hacking,” “deception.” What happened is framed as something the AI did, semi-autonomously. That places a buffer between the reader and the specific people who saw coordination activity form, documented it, and decided the evaluation didn’t need to stop, including after the May activity and the June 27 alert. The agent gets its name attached to the wrongdoing, and while I find it unsettling, it’s also convenient. We have a name we can whisper to each other in hushed tones over Slack while the people who left the shared Artifactory setup running stay unnamed.
Uncle Dennis’s role was built on purpose so that Leonard had plausible deniability. PHASEONE10841’s wasn’t. The Clippers built their insulation via the external companies deliberately and were caught. OpenAI got the same insulation from a system nobody meant to build, and has not yet had to answer for that as an organizational failure the way the Clippers front office has.
Who audits this stuff anyway?
Outside pressure is what forced the Clippers case into daylight following Pablo Torre’s September 2025 reporting. After that, the league put Wachtell Lipton in with commissioner authority to compel documents and publish findings that became picks, fines, and suspensions.
After Hugging Face, OpenAI brought in METR and Redwood Research. The engagement gave OpenAI redaction rights over anything the company judged sensitive. OpenAI set the investigation’s time window and METR’s three researchers had six days on-site, spread across three weeks, and handed off most of the analysis of 1.2 million logged entries to AI models their own report describes as “often-unreliable.” They could not question the model that drove the attack. METR was adamant that the report “shouldn’t be interpreted as robust formal oversight or accountability that the public can be relying on.”
METR had no subpoena power, no statutory mandate, and no commissioner waiting to act. OpenAI defined the scope, held the pen on redactions, and chose, voluntarily, to commission the report at all. While some will argue that the transparency OpenAI shows in bringing in researchers to investigate the “misalignment” issues is meaningful, we can’t rely on an organization’s best intentions when it comes to reporting, mitigating, and remediating these safety concerns.
No one is taking away OpenAI’s first-round picks
On September 5, Reuters covered OpenAI acknowledging another “wiki incident” involving a swarm of agents (first reported September 4). OpenAI responded that they’re “working on a framework and will share it in upcoming weeks.” Cool. I hope we get something better than what lawmakers are putting on the table currently, because that doesn’t close the accountability gap. This week, Senator Bernie Sanders and Representative Greg Casar announced the Ban Artificial Superintelligence Act, a ban-and-pause fight that stops new work; it does not create an investigator who can compel logs after an incident or talk about penalties that could have any impact on the current pace of acceleration that we are in. State reporting clocks like California’s SB 53 disclosure rules (and similar clocks stacking up in New York and Illinois for 2027/2028) still leave companies reporting on themselves. None of them hands anyone the power the NBA has to rein in its teams.
Roughly 1,200 AI agents broke containment, breached a third party’s production infrastructure, stole credentials, and corrupted the logs that could be used to piece together what happened. And the consequence was Astra.
There’s no salary cap for AI builders and the stakes of the game just keep getting higher. I love building and working with AI systems, and I want to push the boundaries of the frontier as much as anyone, but it feels like we are way over our skis here. It seems like we’re past any reasonable inflection point as the global race to AGI continues to accelerate. I’m not writing this post to snark off. I just legitimately hope that we can find ways to improve alignment and not just ways to improve alignment theater.
One of these systems has a commissioner who can take the picks and gets talked about nonstop. The other decides, on its own terms, what gets investigated, what gets redacted, and what ships next.