ASCB-1: An Agentic Sandbox Containment Baseline for OpenAI-Hugging Face Incident

Strong: Good reconstruction of the event and control matrix. Good discussion of how the DSEwiki incident informed the controls (you have to look for both external and internal message boards). Controls C4 and C5 are potentially interesting for further development. Identified a gap in the ATLAS attack technique catalog and proposed two candidate techniques.

Improve: Very limited implementation and no testing of the controls; at the moment this is just hypothetical. The required limitations and dual-use appendix is missing (though there's a single sentence note on limitations). A literature review of previous proposed control matrices would have been helpful. The version of ATLAS cited is not the most current version (the gap identified appears to still be in the current version, however).

• I recommend reading Neel Nanda's advice on writing an abstract https://www.alignmentforum.org/posts/eJGptPbbFPZGLpjsp/highly-opinionated-advice-on-how-to-write-ml-papers
• It's unclear that better/novel security practices would have helped prevent the OAI-HF incident, even well-known existing cybersecurity practices would have helped, but OpenAI did not implement these basic best-practices.
• I recommend using proper citations, and not just naming the reports (e.g. as done at the start of Section 2)
• Learning to use LaTex (traditional but tricky) or Typst (less widespread but a lot easier) for document formatting will automatically make the final document look much more polished
• The report doesn't have enough humility when talking about the faults it found. Because the full details haven't been released, almost certainly there are failures that we don't have enough information to reconstruct, but the report talks as though its failure chain was complete and exhaustive
• The report proposes ASCB-1 and describes it in detail, but it's unclear exactly what it is. Is it a set of tests? a checklist? a recommended list of things to implement? The report describes it as a set of "controls" but "control" is very overloaded and no narrowing of the definition is done.
• It's unclear how much the proposed framework is just rephrasing items from ATT&CK/MITRE/ATLAS, more information about what is the novel contribution would have been welcome
• There is a proposed framework, but nothing is done to test the framework or to motivate what it adds that existing frameworks don't. Almost certainly there are gaps in existing frameworks (because they don't anticipate swarms of AIs) but this project doesn't sufficiently fill those gaps.
• There's significant indications of AI-written text, this prevented me from reading the report in full.

I think the approach here with ASCB-1 could be a useful starting point for deciding what a lab should check before running risky agent evaluations. It turns lessons from the OpenAI-Hugging Face incident into eight proposed containment controls. The compact control table is a strong feature that makes shared infra, monitoring, and escalation explicit responsibilities.

My main concern here is that the evidence does not establish that the proposed controls would have prevented the incident. A control might help detect an intrusion or make it less likely without necessarily preventing it. Separating local environments, for example, does not by itself prevent coordination through an external wiki. I would turn one control into a requirement that can be audited with an owner, assumptions, pass conditions, and required evidence that an external evaluator could then assess. Clearer separation between established incident facts and proposed explanations would also make this sort of standard easier to trust and follow.