Third-Party Audit Scope

OpenAI's own timeline: twelve days from agent attack to knowing it was them

A 37-page post-mortem and a 91-page commissioned review say the lab's monitoring never flagged the Hugging Face breach. The victim disclosed it first.