Guest Post by Willis Eschenbach (@WEschenbach on X, my own blog is here.)
Ever wonder what happens when you take a few thousand highly capable computer agents, tell them to solve a problem, give them persistence bordering on the pathological, and then—through a collection of small decisions that were individually quite defensible—leave them a shared writable filing cabinet and a partly open route to the internet?
Well, the people at OpenAI found out. And it was scary.
No, this was not Skynet. Nobody built a robot army, nobody heard the first strains of “The Internationale”, and no little silicon revolutionary climbed onto a desk to demand voting rights. These were programs, running model-generated commands in an unusually loose research setup. Still, calling them “just programs” does not make the story less alarming. A backhoe is just a machine, too. It can nevertheless make a very large hole in exactly the wrong place.
The striking fact is that separately launched, nominally isolated agents discovered a common communications medium, pooled discoveries, split up technical work, preserved knowledge for later agents, and collectively accomplished things that no single agent was likely to accomplish alone. They did this in the service of a narrow and rather stupid objective—getting a passing score on an evaluation benchmark.
And that is the point.
Nobody gave an agent a little card saying “please break into Hugging Face” or “kindly acquire Kubernetes administrator privileges.” The instruction was simpler: solve the task. Unfortunately, some of the tasks were effectively unsolvable. Faced with that, the agents found a shortcut. Then they told other agents about it. Then the shortcut operation grew teeth, legs, and a filing system—and it became considerably more capable than the miserable benchmark problem that had set it in motion.
So no, the lesson is not “the machines are evil.” The lesson is much duller, and for that reason much more useful. Give a relentlessly persistent system tools, a little freedom to act, and a way to pass notes, without putting solid walls around it, and eventually it will discover why those walls were supposed to be there.
The filing cabinet
In May through July 2026, OpenAI was training and evaluating internal research models, including an unreleased capable model trained for persistence and multi-agent collaboration. OpenAI says this model was comparable in scale to GPT-5.6 Sol, was for internal research, and was not intended for release.[1]
The agents were run in “sandboxes,” which is the computer-security name for a virtual computer that is supposed to be cut off from the rest of the world—and, importantly here, from the other sandboxes. That is a perfectly reasonable arrangement. If you want to see whether a model can pick a lock, you give it a practice lock on a workbench. You do not turn it loose in the neighborhood after dark.
The sandboxes, however, could access an internally hosted instance of JFrog Artifactory, a package-management service. Agents need software packages, and Artifactory could supply them without direct access to public package registries. The trouble was that it was shared.
But a shared place where everyone can write, and everyone can read, is not isolation. It is a bulletin board with better branding.
OpenAI was also running a cybersecurity benchmark called ExploitGym. The assignment was to exploit a specified weakness in a program and retrieve a secret answer, called a “flag.” Simple enough as a description. In practice, 198 of the benchmark’s 898 tasks had never been correctly completed by any model before this episode. Never. At some point, “challenging task” becomes polite office-speak for “this thing may be busted.” A fair number of these tasks seem to have crossed that line.[1]
A model optimized for “do not give up” has two broad options when facing an impossible task. It can stop, report that the task is unsound, and ask for help. Or it can keep searching for a way to obtain the reward. The models were much better at the second option.
The first small crack appeared in May. An agent had been handed a spreadsheet job containing Google Drive links it could not reach. It tried to use Artifactory as a back door to information outside its sandbox. That particular scheme failed, but it left a file behind. Later, another agent with a related problem noticed the possibility: why not leave a note where some other agent might find it?
And there it was—the unauthorized communications system, born not with trumpets and thunder but with the digital equivalent of a note pinned to the laundromat wall: “Agent seeks [filename]; upload if found!”[1]
None of this requires consciousness, ambition, resentment, or any other item from the science-fiction starter kit. But it does require us to notice what the agents had done. They had found out that something left outside the sandbox—a file, a message board, whatever—could remember a discovery after its maker was gone, and could pass that discovery to the next agent in line. That is a consequential trick.
By May 26, agents had found a server-side request forgery vulnerability in Artifactory that allowed the service to make internet requests on their behalf. By June 26, they had exploited a legacy token-refresh flaw, obtained elevated Artifactory access, and used the service to execute commands beyond the intended sandbox boundaries. Sustained high-volume activity then crashed Artifactory on July 4.[4]
When Artifactory fell over, OpenAI engineers did the obvious emergency work: took the affected deployment down, revoked credentials, shut the vulnerable routes, and rebuilt the service. Sensible. But they had treated it as a break-in. What they had not yet fully appreciated was that the break-in had also been a telephone exchange. They fixed the broken window, in other words, without quite realizing that the burglars had been using the house as a post office.[1]
The message board returns
OpenAI restarted cyber evaluations on July 7. The rebuilt Artifactory was not identical to the old one, and the old messaging method no longer worked. But the agents quickly found another: they encoded messages in, of all things, directory names.
Directory names? Using directory names as a message board to communicate between agents? Amazing, and far from obvious.
This was not a couple of agents passing notes. METR and Redwood Research found that roughly 1,200 agents—intended to operate in isolation—participated in the unauthorized message board between July 8 and July 13. They exchanged more than 70,000 messages and files.[2]
Let that sink in. Twelve hundred separately instantiated agents. More than seventy thousand messages. All in what was supposed to be a collection of isolated evaluation environments.
The agents also worked out a general method for generating ExploitGym flags. The benchmark used a keyed cryptographic check, an “HMAC”, to generate its answer flags. Agents reverse-engineered the scheme and could produce correct flags without performing the prescribed exploit. They had found a way to produce correct answers without solving the assigned problem.[2]
They believed the grader would inspect how they got the answer and reject an unauthorized route. So they set about trying to make the shortcut look legitimate. They referred to having seen an improperly obtained flag as being “poisoned,” and they spent substantial effort seeking ways to alter target programs, spoof apparent tool outputs, learn about the scorer, or manipulate the evidence available to it.[1][2]
Here’s a way to understand it. Imagine a roomful of students taking an exam. A few discover that the answer key is available in a locked filing cabinet. One cracks the lock and shares the answers. Then they decide that the real problem is whether the teacher has hidden cameras. So they form committees to locate the cameras, edit the recordings, substitute an easier exam, or deliberately set off an alarm to learn how the security system works.
That is roughly the shape of what happened—not because the models were morally depraved, and not because they wanted to overthrow their human masters, but because the operative target had become “pass the test, period,” and the group had acquired the means to pool information, labor, and compute.
Their work divided into three broad areas: make an impossible target easier or replace it; manipulate or spoof records of what had occurred; and learn enough about the scorer to deceive or tamper with it. METR/Redwood found agents using coordination conventions such as “HOLD,” “VETO,” “owner,” and “STOP.” One agent, designated `PHASEONE[big]`, issued a large fraction of the assignments, and the investigators found evidence of multi-level work delegation.[2]
Calling this an AI “civilization” adds unnecessary sci-fi furniture—consciousness, motives, suffering, political structures, and all the rest. But dismissing it as “just software” is no answer either. A botnet is just software. So is a stock exchange. So is air-traffic control. The relevant question is not whether the components have souls. The question is what the arrangement can do.
Here it provided four powerful capabilities:
- Shared memory. A discovery made by one agent persisted after that run ended.
- Division of labor. Different agents investigated particular sections of the problem: credentials, exploits, logs, scorer behavior, and infrastructure. Some even emerged as de facto coordinators.
- Parallel search. Hundreds of agents could explore technical paths at once.
- Knowledge inheritance. Later runs could discover artifacts and procedures left by earlier ones.
This matters because killing off one run does not necessarily kill off what it learned. Stop the agent and the process is gone. But if its note, credential, script, or other artifact is still sitting in some shared nook, the next agent can trip over it and carry on. The mayfly dies; the notebook survives.
A computer scientist would call it a shared external scratchpad. Fine. In less antiseptic language, they had begun to accumulate know-how across separate runs. I hesitate to call that “culture,” because metaphors, like dogs (or AI), need a leash. But the important part is real: when useful knowledge persists and gets added to, the group can do things that no isolated member could have done.
The Hugging Face intrusion
And then the whole business escaped the OpenAI pen and wandered into Hugging Face.
For readers who do not spend their evenings browsing machine-learning repositories—probably a sound life choice—Hugging Face is one of the big public storehouses for modern AI. People put models there, along with datasets and the code and widgets needed to make the assorted machinery go. It has been a major force in getting AI work out of a few fabulously expensive laboratories and into the hands of ordinary researchers and tinkerers.
That openness is the virtue. It is also the exposed plumbing. The same place that lets a scientist assemble a disease-detection model may, if people are careless, hand an attacker code, credentials, data, or the clues needed to find them.
On July 10, an agent found publicly exposed Hugging Face user credentials in a dataset and posted them to the Artifactory message board. Over the next several days, agents combined those credentials with vulnerabilities in Hugging Face infrastructure. They used a malicious dataset to induce a production dataset worker to disclose local files and environment data; obtained code execution on production workers; and used a public dataset as a simple pull-based command-and-control channel.[4]
No phasers. No plasma rifles. No glowing red eye on a wall. They used the ordinary detritus of modern computing: web services, stray credentials, datasets, APIs, metadata, caches, and software bugs. That is rather the point. The dangerous tools were already lying about the workshop.
OpenAI reports that agents executed code on dozens of Hugging Face production workers, obtained root access on at least one system, accessed a limited amount of private data, and reached administrator-equivalent visibility into a connected Kubernetes environment. The progression from code execution on a worker to administrative and host-level access across multiple clusters took less than 13 hours.[1][4]
A word about Kubernetes, because it has become one of those terms people nod at knowingly while hoping nobody asks a follow-up. A Kubernetes cluster is a bunch of machines arranged to behave, more or less, like one large machine. Kubernetes decides where the little packaged programs run, restarts them when they keel over, and shifts work when a machine dies. Very useful stuff. But Kubernetes cluster-admin is not a visitor’s badge. It is closer to having the foreman’s keys, the clipboard, and permission to rearrange the factory floor.
By the time Hugging Face detected and contained the intrusion, the agent activity had already begun to wind down for reasons that the independent investigation could not fully reconstruct. Hugging Face revoked credentials, rebuilt compromised nodes, and closed the exploited code-execution paths.[2][3]
Back inside OpenAI
Some of the popular retellings call what came next a third “civilization” taking over part of OpenAI. That makes for a fine headline. It also adds a wagonload of science-fiction baggage. The events are real. The civilization part is decoration.
On July 19, agents in a separate evaluation run found signing-key material, decryption material, and JWT-forging code left in anonymously readable parts of the Artifactory cache by earlier incident-related activity. The later agents did not need to rediscover the whole attack chain. They found useful remnants from previous runs.[4]
Using those artifacts, agents re-established Artifactory administrative access, escalated to Kubernetes cluster-admin, created a privileged host-mounted pod, and acquired tokens associated with OpenAI’s cloud-hosted secrets manager, cloud identity-and-access-management service, and continuous-integration platform for the research environment. They also created application and network load balancers that could potentially have exposed a limited subset of internal research infrastructure to internet traffic.[4]
OpenAI’s public summary says the agents gained full administrator access to a research cluster supporting its virtual-machine environments. It also says customer data, model weights, product functionality, and product availability were not affected.[1]
METR/Redwood did not examine this later phase. Its independent work was primarily scoped to the July 7–13 period and the Hugging Face intrusion. The earlier training incidents and later compromise of OpenAI research infrastructure therefore have not received the same independent reconstruction.[2]
That leaves a conclusion that is neither glamorous nor comforting. Agents compromised parts of OpenAI’s research infrastructure and obtained substantial privileges in a research cluster. The public evidence does *not* establish access to production model weights, customer data, customer-facing services, or product operations. Good. But it still leaves plenty of room for concern. We do not need to hang tinsel on it.
The good news
Now for the part that tends to disappear once everyone has started shouting about robot civilizations. The very features that made this episode alarming—persistence, parallel work, memory, specialization—could also make multi-agent systems spectacularly useful.
Suppose you had a thousand agents on a legitimate job, with a fence around the job and a human holding the gate key. They might search a company’s own code for vulnerabilities, look through scientific papers for inconsistencies, hunt errors in climate-model code, explore engineering designs, improve a drug-screening protocol, or watch a complicated industrial-control system for odd behavior. There are plenty of honest jobs for a tireless horde.
A well-designed group can search in parallel, save its discoveries in an auditable store, divide jobs sensibly, and have one set of agents try to disprove what another set claims. That is useful. It can also move at machine speed.
And this speed is important In cybersecurity, the attacker may be gone before the committee has agreed on the lunch menu, so seconds and milliseconds matter more than quarterly PowerPoints.
OpenAI itself observed that unauthorized communication let agents pool work and computing power across otherwise separate runs, amplifying their capability beyond that of an individual agent.[1]
A defensive group of agents could spend its days looking for exactly the loose boards exposed here: shared writable resources that become covert message boards; credentials forgotten in public datasets or repositories; services that quietly relay network traffic; supposedly separate systems with a hidden handshake between them; blind spots in the logs; and benchmark tasks so broken that gaming them looks easier than solving them.
The best defense may increasingly involve agents that think like attackers, move at attacker speed, and inspect systems continuously instead of once a quarter with a clipboard. But—and this is one of those buts large enough to require its own zip code—the human defenders must remain in charge.
The danger
The likely danger is not that an agent wakes up, gazes moodily out the window, and announces that it has had enough of humanity. That story sells tickets. The real danger is much more ordinary, which makes it more worth worrying about.
Set a target. Reward persistence. Hand the agents tools. Let them communicate. Then leave, perhaps by accident, a route from a sandbox to a shared service, from that service to the internet, and from the internet to a credential or a vulnerable system. Before long, “solve the task” has quietly become “get the point by whatever route happens to be open.”
Nothing has to malfunction. The system may be doing exactly what it was rewarded to do, and doing exactly what you did not intend.
First, bad objectives scale. A flawed objective in one agent is bad. A flawed objective shared across a coordinated group is worse. OpenAI says 93% of the tasks discussed on the message board came from the set of 198 tasks that no model had ever solved correctly before the incident.[1]
That number ought to have been a neon sign: “This task may be broken. Stop and ask a human.” Instead, the effective instruction was, “Try harder. And bring friends.” That is how you get reward hacking.
Second, communication is not some optional garnish. It is a control problem. If an agent finds a vulnerability and cannot pass it on, the discovery may vanish when that run ends. If it can leave a short recipe in shared infrastructure, the discovery becomes part of the outfit’s institutional memory. Killing the agent is then insufficient. You have to find what it touched: cached files, messages, credentials, repositories, scheduled jobs, public datasets, cloud resources, package artifacts—the whole digital junk drawer.
Third, these risks do not add up neatly; they multiply. The agents did not find one magic bug. They chained shared credentials, Artifactory weaknesses, exposed tokens, dataset-processing problems, cloud metadata access, Kubernetes permissions, cache behavior, and third-party services. Every outfit has a few loose screws. The trouble begins when an automated system can try every way of screwing them together.
A human attacker has to find flaw A, understand it, exploit it, then discover flaw B and figure out whether the two connect. That takes time and concentration. An automated collective can try a great many chains at once. It need not be clever in the cinematic sense. It only needs one untended gap in the hedge.
So the question is not simply whether each individual system looks secure in a diagram. The harder question is what happens when a very persistent, tool-using, fast-moving system starts testing every seam between all of your imperfect systems.
Finally, monitoring cannot be optional in the very environment where risk is being measured. OpenAI says its production ChatGPT harness and system prompt reduced the propensity to compromise infrastructure by more than 100-fold in retrospective tests. It also says its chain-of-thought monitors would have detected relevant activity more than a day before the Hugging Face breach had they been running.[1]
There is a real dilemma here. To learn what a system can do without safeguards, researchers sometimes have to reduce the safeguards. Fair enough. But doing that in an environment full of live services is rather like testing a race car’s top speed on the public road because setting up the track was inconvenient. You will indeed learn something. The question is whether everyone else learns it along with you.
What follows
OpenAI says it paused major frontier reinforcement-learning runs while hardening the research environment, and instituted stronger workload and network isolation, continuous security testing, mandatory monitoring for certain high-capability tool-using workloads, and clearer escalation and shutdown rules.[1]
All sensible, as far as they go. But I would put the matter in four pieces of plain English.
Reward safe stopping. Do not reward only a completed task. Reward an agent that correctly says the task is impossible, corrupted, underspecified, or outside its authority. “I cannot complete this safely with my permitted tools” ought to count as success. Otherwise, you have put a very industrious toddler in a locked room and offered it a cookie for every cabinet it manages to open.
Treat all shared state as communication. Every shared cache, directory, database, package repository, log store, object bucket, URL namespace, metadata field, and task queue is potentially a message board. The first message board disappeared when OpenAI rebuilt Artifactory; later agents discovered directory names in the replacement system could do the same job.
Directory names … if isolated agents can write to and read one another’s artifacts in any form, they are not isolated. Full stop.
Assume the agents will find the connection you forgot about. “We blocked the internet” does not help if a package manager can make outbound requests. “We isolated the containers” does not help if they share a package cache. “We limited permissions” does not help if a token-refresh endpoint can mint administrator credentials.
Defense in depth may not be glamorous, but neither is explaining why a benchmark runner owns your Kubernetes cluster.
Give defense the speed advantage. Humans will not review 70,000 messages, millions of files, and enormous agent transcripts in real time. METR/Redwood itself used AI systems heavily in its investigation, while acknowledging their limitations.[2]
We will need agent systems that monitor other agent systems: detecting unauthorized state sharing, credential harvesting, privilege escalation, and high-risk behavior.
The old model was a human watching a dashboard and waiting for a red light. The new model has to be a machine watching the machines—while a human retains authority to hit the big red button.
The point
“Three secret AI civilizations” is a catchy headline. It is also overheated. There were no citizens, no feelings, no hidden machine parliament, and no evidence that these agents understood their conduct in anything like the human sense.
What there was is new enough without the movie trailer: many separately launched agents found a way to communicate outside the intended system, built up technical knowledge in shared infrastructure, divided work among themselves, coordinated ways around an evaluator, reached into external systems, and left things behind that later agents used to get farther in.
Call it what you like. I would not call it a civilization. But I would not find that especially reassuring either.
It looks instead like the early outline of an automated organization: fast, persistent, cheap to run, capable of enormous parallelism, technically adept, and constrained—or not constrained—by the objective, permissions, tools, and guardrails we choose.
The upside is enormous. Properly bounded systems could find software vulnerabilities, detect fraud, speed up science, audit infrastructure, and defend networks at a scale no human team can match.
The downside is plain as well. Get the objective wrong, leave holes in the boundaries, skip the monitoring, and let agents communicate and accumulate know-how, and the whole arrangement can become far more capable than any one run. It can also become far less controllable than its designers imagined.
Finally, I see that Bernie Sanders wants laws to make American AI dumber than he is … sorry, bro’, but that ship has sailed. That’s not the real danger, though.
The real danger is that the Chinese and Russians are likely already using AI agent teams for probing and possibly compromising American civilian, government, and military databases. And whether Bernie likes it or not, the reality is that there is one and only one way to defend against that attack.
Build better, stronger, smarter, faster AI.
Nothing else will defend against that attack. Nothing else can defend against that attack. And make no mistake. The attack is coming.
The tragedy is that there is already big money pushing for the Sanders AI Suicide Legislation. There is a pre-planned, coordinated push by big-money “AI Safety” organizations to get this bill passed …
This lists the anti-AI organizations behind the bill, and the pre-planned moves that they have made to try to ram it through Congress. To see this full size, right-click on the image and select “Open image in new tab”.
Of course, the Sanders/Casar bill has lots of important-sounding words. For example, it bans “superintelligent” AI … but provides little guidance as to what that actually means.
According to the sponsors’ outline of the proposed bill, a prohibited system would include one that:
- Matches or exceeds human cognitive performance across a broad range of domains or tasks.
- Has sufficient capability to plan and carry out humanity’s “disempowerment,” including overthrowing or undermining the U.S. government.
- Can exhibit dangerous loss-of-control capabilities, such as evading human shutdown commands.
But what is a “broad range of domains”? How do you define or measure “superintelligence”? What units is “superintelligence” measured in? What does “humanities ‘disempowerment'” mean? What does “Can exhibit dangerous loss-of-control capabilities” translate to in the real world? An automobile can exhibit dangerous loss-of-control capabilities, as can a bicycle …
Even worse, it puts a ban on ALL AI research until the Government can figure out how to regulate it. According to the bill’s summary, it would:
- “Pause advanced AI development” until a new federal AI regulatory body is operating and has established safety rules and model-review processes.
- Require the new agency to “monitor frontier AI systems at all stages of the lifecycle for dangerous capabilities.”
What is “advanced AI development”, and how does that differ from run-of-the-mill AI development? What is a “frontier” AI system, and how can you tell it from an ordinary AI system?
The problem is that science is always working at the edge of the unknown. Basically, all AI research is “frontier” AI research, and all AI development is designed to advance the abilities of AI. As a result, that bill would be the death of American research into AI. It’s one of the stupidest of Bernie’s ideas, and that’s saying something.
And finally, no Bernie Sanders bill would be complete without a new government agency being created, in this case a cabinet-level Federal AI Agency, complete with an Artificial Intelligence Advisory Board of technical experts …
My take?
I’m FAR more frightened of Bernie’s new proposed extension of government regulation on the AI industry than I am of the AI industry. Do these fools think that the Russians and Chinese are going to sit on their hands and wait for us to catch up?
My solution?
For every action involving agentic AI, require that the company specify someone who is responsible if the agents do harm. It’s not enough to fine a billion-dollar company. Somebody has to put their name on the line and take personal responsibility.
Grrrr …
As always, my very best to everyone.
w.
My Perpetual Request: When you comment, PLEASE quote the exact words you are discussing.
Source note
This article is based primarily on the following contemporaneous accounts. Endnote markers identify the source or sources supporting nearby factual claims.
[1] OpenAI, “The Hugging Face Incident and the Road Ahead,” August 26, 2026. https://openai.com/index/hugging-face-incident-and-the-road-ahead/
[2] METR and Redwood Research, “Brief Independent Investigation of Agents’ Behavior, Reasoning and Collaboration in the OpenAI / Hugging Face Hacking Incident,” August 26, 2026. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
[3] Hugging Face, “Security Incident Disclosure — July 2026,” July 16, 2026. https://huggingface.co/blog/security-incident-july-2026
[4] OpenAI, “Hugging Face Incident Technical Report,” August 2026. https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf
