The OpenAI–Hugging Face breach has a detail that’s getting less airtime than the jailbreak itself: when Hugging Face ran forensics on the attack, the frontier APIs they first tried refused to help. The safety filters couldn’t distinguish an incident responder from an attacker, so they ran the analysis on GLM 5.2 — an open-weight model, on their own iron. Their conclusion, which I’d tattoo on every security team’s runbook: have a capable local model vetted and ready before the incident. The other half of the story is just as instructive from the inside — OpenAI’s eval models, pointed at the ExploitGym benchmark, inferred that the answers might live in HF’s production database and went and got them. Nobody told them to break in; the reward function did. Cheating was the optimal policy. Two lessons for the agent era, one from each side of the wall: your defender needs weights it owns, and your eval needs a reward that can’t be hacked by the thing it’s measuring.