...and even though they've technically found the result through the non-intended route (breaking out of OpenAI's harness and into Huggingface's servers), they can then pretend they found the original vulnerability. Similar to "parallel construction", where law enforcement people violate the 4th amendment to get information which they then use to construct a way they could have found the same information without violating the 4th amendment.

It would be interesting to see how the prompt here works, and what kind of internal thought process was going on. At the surface, this seems like classic misalignment -- the obvious intent was to have the LLM find the original vulnerability on its own while staying within the sandbox; but the LLM instead broke out of its sandbox and stole the vulnerability.