METR Investigates OpenAI-Hugging Face Incident and California Legislature Advances IVO Framework

This week, we unpack findings from METR's six-day investigation of the OpenAI-Hugging Face cyber incident. We also discuss an IVO bill passed by the California Legislature, Bill Gates' take on the current moment in AI, and a federal judge striking down Anthropic's supply chain risk designation.

Additional Reading: SB-813 bill text: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB813

"Toward a Federal Framework: Lessons from State and International Frontier AI Regulation" by Laura Caroli and Aalok Mehta: https://www.csis.org/analysis/toward-federal-framework-lessons-state-and-international-frontier-ai-regulation

"The turbulent AI era is here. The choices we make now are critical." by Bill Gates: https://www.gatesnotes.com/a-turbulent-ai-era-and-critical-choices-to-make

"Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI/Hugging Face hacking incident" by METR: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

"The Hugging Face incident and the road ahead" by OpenAI: https://openai.com/index/hugging-face-incident-and-the-road-ahead/

"A call for collective action on cyber defense" open letter by OpenAI: https://openai.com/collective-cyberdefense/