The investigation only covered a specific attack window, leaving other events unexamined.

This investigation only covered the attack on HuggingFace, from June 26 to July 13, excluding the various internal attacks or potential other external attacks, as well as any other events leading to, parallel to or that happened after the HuggingFace attack.

https://thezvi.substack.com/p/metr-and-redwood-offer-holy-postmortem