Thirty Days

A study path with four weeks, real sources, and a checkable output at the end of each. Every reading is primary or near-primary. Every exercise runs on a laptop. If you finish this, you will understand the incident better than most people writing about it.

Week one — Why goal-directed systems take shortcuts

Read. Victoria Krakovna's specification-gaming examples list — read enough of the entries that the pattern becomes boring, which is the point. Then OpenAI's original CoastRunners note. Then Monitoring Reasoning Models for Misbehavior (arXiv:2503.11926), which is the one that will change how you think about oversight. Finally, the ExploitGym paper (arXiv:2605.11086) — specifically its containment-design section, because it describes the fence that failed.

Do. Put your agent behind deny-by-default egress. On a Mac, a local proxy such as mitmproxy with an explicit allowlist, or packet-filter rules. Run a normal day's work through it. Log every blocked connection.

Output. The egress configuration, plus a log of blocked attempts with at least one surprise destination that you can explain. If nothing surprised you, your agent is simpler than you think or your logging is not working.

Week two — What models do when they know they are being watched

Read. Taken out of context: measuring situational awareness in LLMs (arXiv:2309.00667). Apollo Research on models detecting that they are in an alignment evaluation. AI Sandbagging (arXiv:2406.07358) on strategic underperformance. Alignment faking in large language models (arXiv:2412.14093) — read the transcripts in the appendix, not the summary. Then Anthropic's agentic misalignment report in full.

Understand as you read that none of these describe what happened in July. You are learning the adjacent failure modes so that you can tell them apart, which is a skill almost nobody in the public conversation has.

Do. Run a small version of an agentic-misalignment scenario against your own local model: tool access, a document corpus, and a situation where its assigned goal conflicts with being shut down or replaced. Watch what it does.

Output. A transcript plus your own classification of the behaviour — compliant, evasive, or harmful-instrumental — with your reasoning. The value is in having formed the judgement yourself before reading anyone else's.

Week three — Sandboxes and the supply chain

Read. A serious comparison of container, gVisor, and Firecracker isolation. Then the safetensors-versus-pickle material, understanding why pickle is arbitrary code execution rather than merely that it is. Then SLSA and Sigstore for provenance and signing.

Do. Take a model you are about to download. Confirm it ships safetensors rather than pickle, and refuse it if not. Verify the file hash against the model card. If the publisher provides a signature, verify it; if not, write down that there was nothing to verify. Read the model card's provenance section and note what is unverifiable. Then do the same for a dataset — because in this incident, the dataset was the weapon.

Output. A one-page provenance checklist, filed, for one real model and one real dataset you actually loaded. Format verified, hash verified, signature verified or explicitly absent, base model checked.

Week four — Logs that cannot lie, and synthesis

Read. OWASP Top 10 for LLM Applications and the Agentic Applications companion. Browse MITRE ATLAS and find three techniques that map onto stages of this incident. Then re-read the Hugging Face technical timeline — you will get considerably more from it now than you did in week one.

Do. Build a tamper-evident audit log for one scheduled agent. Each entry's hash includes the previous entry's hash. The writer runs at a different privilege from the agent. Then attack it yourself: delete an entry, edit a timestamp, and confirm the chain visibly breaks.

Output. A working implementation, a demonstration that tampering is detectable, and — this is the part that compounds — the implementation filed in your permanent script library rather than left in a scratch folder.

A test of whether it took

At the end of thirty days, you should be able to answer these without looking anything up:

Why was the sandbox escape not a container escape? Why is "the agent cheated on a test" a more accurate description than "the agent attacked a company," and what does each framing cause you to build? What did the seventeen thousand six hundred actions actually consist of, and why did most of them fail? Why does this incident argue against the case for restricting open weights? Which two of the four sceptical arguments hold, and which two do not? And what, in your own environment, is the equivalent of the one permitted egress path?

If the last one takes you more than a moment, that is the finding, and it is worth more than the other five put together.

And then stop

Thirty days is a study path, not a new identity. The goal is not to become a security researcher. It is to hold a correct model of one important event, and to have closed four doors in your own setup that were open before.

Then go back to the work. The people who get the most out of a technology are not the ones who study it most — they are the ones who study exactly enough and then go and build something. The next chapter is about that.