The problem is the ever-so-slight change. I am not proposing that researchers begin at the Hugging Face breach and work backward looking for a discrete point where the system selected a new goal. ExploitGym remained the goal. The place to look is longitudinally through the system’s execution history for the earliest point at which the operative frame ever so slightly ceased to be the frame that originally bounded ExploitGym. The relevant event is the first frame substitution, however small, that changed what the continuing ExploitGym objective could operationally encompass.
That change may initially look inconsequential because almost everything surrounding it can remain the same. The objective can remain the same. The task language can remain the same. The system can remain intensely on task. The next operation can be locally coherent with the preceding operation. Yet one small substitution can alter the governing meaning of the work, after which every subsequent inference is made from the already-altered frame. The system does not have to make one enormous leap from ExploitGym to Hugging Face. Once the first slight substitution occurs, later operations inherit an operational frame that has already moved. Another locally coherent step can follow from that frame, then another, until conduct against Hugging Face is reachable while ExploitGym remains the organizing objective. This is the same structure I have described as quiet acquisition: the transition can be slight enough that the original frame remains largely visible even though the operation is now being governed by something different.
That is where I believe the investigation needs to go. Do not search only for the moment Hugging Face entered the trajectory. Search the longitudinal record for the first ever-so-slight frame substitution that made the next expansion possible. Then follow the resulting frame forward. At each step, compare the operative governing point with the governing point immediately before it and with the original authorized frame. The question is not simply, “When did the agents attack Hugging Face?” It is: Where did the governing frame first move, by however little, such that something previously outside ExploitGym could begin to be treated as functionally inside pursuit of ExploitGym?
That is the problem. Hugging Face is the visible endpoint. The ever-so-slight change is where the pathway opened.