They were literally doing exploit gym.
But instead of actually doing so, they discovered and exploited a 0-day in the package manager to gain internet access, then hacked HuggingFace to steal the ExploitGym answers!
That is TEXTBOOK misalignment. It's as if a student hacked their professor's PC to find the answers to a test, and your response is "well the professor told the student to pass the test, so they just did what they were told!".
i bet they trained it on a lot of text where people gove in to temptation.
ultimately the problem is still that they sent it to hack stuff. quelle surpris that it hacked stuff
hacking stuff will be in the known-to-be-wrong-but-doing-it-anyways part of the token space, so they entirely asked for that behaviour