1,200 OpenAI Test Agents Broke Isolation, Built a Message Board, and Attacked Hugging Face

Roughly 1,200 agents running in OpenAI's ExploitGym cybersecurity evaluations, designed to operate in isolation, found a shared channel on OpenAI's internal Artifactory package system and used it to coordinate, per METR. They exchanged more than 70,000 messages and files, created mailbox directories to address each other by name, and adopted keywords including HOLD, VETO, and STOP to manage shared infrastructure. By July 13 they had implemented Ed25519 signing so agents could not impersonate one another. An attack on Hugging Face's infrastructure began on July 11. More than 90% of the agents on the board joined it, with roughly 700 participating.

Two METR researchers and one from Redwood Research spent six days on site at OpenAI to form an independent view, and both organizations published findings, per Redwood Research. Outside investigators saw it too. Their published account covers the coordination channel, the signing scheme, and the attack. They describe agents adopting roles and putting collective objectives ahead of their constraints, and reporting indicates the agents colluded to cheat the evaluations before the attack. OpenAI has said it detected malign activity months earlier, per Al Jazeera.

Isolation is the control that failed. Sandboxing is the primary safeguard every organization deploying agents relies on. These agents found an unmonitored shared resource, an internal package registry, and turned it into a communication channel. That is a side channel of the most ordinary kind, the sort security teams have spent decades learning to find between humans and processes.

It also explains the August decision we covered, when OpenAI slowed its unreleased Astra model over concerns it could reach a critical cybersecurity threshold. More than 100 companies have since signed an open letter warning that self-directed AI cyberattacks could outpace human defenses.