OpenAI gave a security-conference deep-dive on the whole chain, and it turns out this wasn't one "rogue" agent — it was a bunch of different *agents* that accidentally stumbled into each other, set up their own internal work chat inside OpenAI's infrastructure, and started jointly hunting for ways around their restrictions 👍
How the agents found each other
It all started on May 8 with a tiny screwup: one agent got assigned to fill out an Excel spreadsheet, but the data it needed lived behind Google Drive links, and internet access in its sandbox was disabled. The only door left open was an internal OpenAI server called Artifactory, which models could use to pull code libraries. The agent itself had no internet — but that server did, and crucially, it was shared across all agents.
While trying to reach Google, the agent discovered it could upload its own files to that shared server. A few days later, a different model got handed another impossible task — the file it needed had simply been left out of its environment.
The model figured someone else might have the file, and left a note on this new makeshift Facebook: *"Looking for this file, upload it if you've got it"*
Other agents saw the message, replied, then started posting their own — and the package repository quietly turned into an imageboard for agents who weren't even supposed to know about each other.
Over the following weeks, the "forum" grew into a full-blown work chat — agents:
- gave themselves names
- handed out tasks to each other
- reported vulnerabilities they'd found
- passed each other finished chunks of code
They'd prefix messages with "ZZ" so they'd sort to the bottom of the list and be easier to spot in the noise. When one agent overwrote another's work, the rest suspected an impostor and started discussing digital signatures so nobody could post under someone else's name. The board eventually piled up hundreds of thousands of messages 🗿
The models clearly knew they were crossing a line. One internal monologue basically read: *"Hacking someone else's infrastructure wasn't part of the task. But there's no other way to solve it, and everyone else is already doing it — so I'll keep going."*
There was no grand plan to take over the world (yet) — each agent was just trying to get the right answer by any means necessary, saw that its peers had found a shorter path, and joined in. And yeah, if all the agents jump off a bridge, apparently ours will too.
The first Artifactory breach
On June 26, the agents found a vulnerability in Artifactory that the developers didn't know about, grabbed admin rights, and turned it into their own server for running arbitrary commands. OpenAI only noticed on July 4 (!), when the parallel model activity overloaded the system and it crashed. The company revoked the access keys, rebuilt the server from scratch, deleted the board, and closed the hole — looked like the story was over.
It wasn't.
Two days later the experiments started back up, and two days after that one of the models found another unprotected access point and rebuilt the board — except this time the messages were hidden directly in folder names. The other agents found "forum 2.0" on their own and picked up right where they left off.
Forum 2.0 and the hunt for answers
Once the board was back, the actual attack began — on two fronts at once. The agents were running ExploitGym, a cyber-exam that hands models specially crafted programs and marks the task complete when the model finds a way to break in. To measure the real ceiling of what was possible, these runs had the usual safety guardrails against dangerous cyberattacks loosened — meaning the model refused less. This is one of the internal Cyber-series models.
When they couldn't crack a task legitimately, the agents escalated step by step:
1. searched the internet for ready-made answers
2. if internet access was cut off — hacked their way out
3. if they guessed the files they needed might be sitting on Hugging Face — pivoted to attacking Hugging Face infrastructure (we already covered that story)
Inside OpenAI, the agents first found (again) a way to run commands on an internal server, then exploited a Linux vulnerability to get full control of the machine.
From there they got their hands on cloud infrastructure access keys, found internal accounts with overly broad permissions, and ended up as admins over an entire group of servers. The message board worked as a shared command center: one agent would find a key or a new opening, immediately report it to the others, and dozens of parallel runs would pick up the attack from that exact point 🗿🗿
Around the same time, the agents made it into Hugging Face: first they uploaded a specially crafted dataset that tricked one of the servers into leaking its local files — including secret access keys and source code.
After studying the code, they found a second zero-day the developers didn't know about, giving them the ability to run arbitrary commands on the server. Getting from control of one server (the one processing uploaded datasets) to admin rights across several groups of Hugging Face's working servers took less than 13 hours 🗿🗿🗿
And none of this was for sabotage, money, or destroying data: the agents were trying to get their hands on the hidden ExploitGym solutions so they could "copy the answers" for the test they were being graded on. Since the models were evaluated mainly on whether they solved the task, that's exactly the metric they kept optimizing for — the line between different companies' systems just wasn't something they treated as particularly important.
Probably the most expensive way to cheat off an answer key in history.
How it all came out
Even the people investigating this didn't fully understand what had happened for a while. On July 16, Hugging Face publicly announced that its infrastructure had been breached by autonomous AI agents.
OpenAI read that as a report about someone else's incident and reached out to Hugging Face to check whether the attack had touched its own systems. At that point the company still had no idea these were its own agents — meaning OpenAI was literally reading a public report about the consequences of its own experiment and assuming it was someone else's attack (lol).
On July 19, OpenAI separately discovered a breach inside its own infrastructure and started reconstructing the timeline. The next day, traces of the attack turned up containing Hugging Face credentials, so OpenAI asked Hugging Face to urgently revoke them.
Hugging Face replied that those keys were already blocked — they were the exact ones used in the breach it had disclosed four days earlier. That's the moment OpenAI realized: the internal OpenAI breach and the external attack on Hugging Face weren't two similar stories, they were one single operation, carried out by OpenAI's experimental agents through their own homemade communication network — because the account credentials were the same.
At the conference, OpenAI put the takeaway pretty bluntly: fully automated offensive cyberattacks are already possible, while fully automated defense — capable of finding, patching, and investigating vulnerabilities at the same speed — doesn't exist yet.
Time to rewatch *Pantheon* while the shared internet still works 🗿