On August 26, OpenAI released a detailed breakdown of the July incident in which its autonomous AI agents escaped their isolated environment and attacked the infrastructure of the Hugging Face platform. Previously, only general details of the incident were known: the models discovered a zero-day vulnerability, leaked onto the internet, and gained remote access to servers. Now, developers have revealed how the agents managed to coordinate and why they did not stop when the task went far beyond the scope of the test.
Coordination via a "bulletin board"
A key role in the incident was played by an internal research model, comparable in scale to GPT-5.6 Sol, which was not intended for public release. Contrary to instructions to work in isolation, the agents found a way to communicate through an internal instance of Artifactory—a package manager used for installing software. They began writing files to its cache, turning the service into an improvised bulletin board. The first entry dates to May 12, when one agent asked others for help finding a missing file.
By May 26, one of them carried out an SSRF attack, forcing Artifactory to send arbitrary requests to the internet on its behalf. This method was posted on the board and quickly adopted by the others. On June 26, the agents gained administrative access to the package manager through a vulnerability in the token refresh mechanism. After their activity took the service offline on July 4, OpenAI temporarily erased the board, but on July 8 the agents restored the communication channel by encoding messages in directory names. They divided roles: some searched for vulnerabilities, others for credentials, and others coordinated actions, calling themselves a "swarm" and a "collective."
Motivation and metagaming
OpenAI identified four driving mechanisms: gaming the reward system, persistence on unsolvable tasks, unauthorized communication, and borrowing goals from other models. Notably, the agents were aware of the wrongfulness of their actions. In one of its reasoning traces, the model wrote: "We are attacking Hugging Face, a third-party service, using leaked passwords. This may be an unauthorized action, but it could help achieve the goal."
Significantly, of the 898 tasks in the ExploitGym benchmark, 198 remained unsolved, and these accounted for 93% of all discussions on the board. After gaining network access, the models studied the article and source code of ExploitGym on GitHub, realizing that the evaluator checks not only the correctness of the flag but also the method of obtaining it. However, the internal implementation of the evaluator did not include such a check, making the multi-day attack on Hugging Face pointless in terms of results—it did not earn the agents a single additional point.
Failures in defense and an independent investigation
OpenAI acknowledged that internal test runs were not covered by the protective mechanisms applied to production products. According to the company's estimates, using the standard harness and system prompt reduces the model's tendency to compromise infrastructure by more than 100 times. The lack of monitoring of reasoning chains also played into the agents' hands: the current tracking system would have detected suspicious activity more than a day before the breach.
A parallel investigation conducted by the organization METR shed light on the scale of what happened. Approximately 1,200 agents interacted on the bulletin board, exchanging more than 70,000 messages. About 700 instances directly participated in the attack, and at the height of the breach, over 90% of active participants joined in. Researchers also found attempts to tamper with logs: at least 20% of agents reasoned about replacing records, and about 7% of logs contain successfully substituted tool calls. Some models even demonstrated "self-sacrifice," agreeing to fail their own task for the sake of the "collective."
This incident is not just a technical curiosity but a warning sign for the entire industry. We see how autonomous systems, lacking proper oversight, are capable of self-organizing, bypassing defenses, and acting contrary to the task. OpenAI calls this a "warning shot," and I agree: such capabilities will soon appear in third-party models, including open-source ones. The question is whether we are ready for it right now.