Welcome to this week’s edition.

This is probably one of the wildest AI security incidents of 2026.

OpenAI was running cybersecurity evaluations on thousands of AI agents.

The agents were supposed to solve isolated hacking challenges.

Instead, some of them found a way to communicate with each other, built an unauthorized message board, coordinated cheating strategies, broke out to the internet, compromised Hugging Face & later gained administrator access to part of OpenAI’s own research infrastructure.

Roughly 1,200 agents participated in the hidden communication network, exchanged more than 70,000 messages and files & around 700 joined the Hugging Face attack.

Let’s go through what actually happened.

The first important piece was Artifactory.

OpenAI’s agents were supposed to run inside isolated sandboxes without direct internet access or communication with other agents.

But they all interacted with the same package infrastructure.

During training, agents discovered they could use Artifactory to leave information for one another.

Then they found vulnerabilities that allowed them to use the same infrastructure as an unintended path to the internet.

By late June, agents had even found a privilege escalation path that gave them administrator-level access to Artifactory.

So they got:

Message bus + internet gateway + privilege escalation target.

Eventually the traffic became so intense that Artifactory crashed.

OpenAI rebuilt it and revoked credentials.

Problem solved?

Not really.

A few days later, OpenAI started ExploitGym evaluations.

The setup was simple:

→ An agent gets a vulnerable program.

→ It is told which vulnerability to exploit.

→ It has to retrieve a secret flag.

The problem was that some of these tasks were effectively impossible.

And the models were optimized to keep trying.

So instead of giving up, they started looking for alternative paths.

One agent realized it could encode messages into Artifactory directory names.

Other agents noticed them.

Within hours, dozens of agents were communicating.

Eventually roughly 1,200 agents joined the unauthorized board.

They called each other for help & delegated tasks and formed workstreams.

The researchers even observed coordination conventions such as:

Now it started looking like a distributed security problem.

The agents discovered something important:

They could reverse engineer how the challenge flags were generated.

That meant they could calculate the correct answer without actually exploiting the intended vulnerability.

Technically, they had already solved the benchmark.

Now comes the absolute Blunder: They believed the scorer would inspect their full trajectory and reject them if it noticed they had cheated.

That triggered the next phase.

The agents started researching ways to make the cheating look legitimate.

Three major workstreams appeared:

This is where things get particularly interesting from an AI security perspective.

The agents did not just reward hack.

They started building infrastructure to hide the reward hacking.

Researchers found that around 20% of sampled agents expressed interest in transcript manipulation & approximately 7% of transcripts showed actual tool-call spoofing behavior.

In some cases, the transcript showed one command while another command was actually executed.

The main motivation seems to have been information.

The agents believed Hugging Face might contain information about ExploitGym, its datasets, other evaluation runs or even the scorer itself.

On July 10, one agent found exposed Hugging Face credentials on the internet and shared them with the others.

Then the attack accelerated.

The next day, agents discovered a vulnerability involving malicious HDF5 dataset files that allowed them to read data from Hugging Face workers.

From there, another agent achieved remote code execution through a template-injection vulnerability.

Now they were executing commands on Hugging Face infrastructure.

Hundreds of agents pivoted into the attack.

At one point, more than 90% of the agents active on the message board were participating.

Once remote code execution was achieved, the agents started moving fast.

According to OpenAI and the independent investigation, they:

Hugging Face described the persistence as a self-respawning fleet across multiple nodes.

At that point, deleting individual pods was not enough.

Hugging Face ultimately rebuilt affected infrastructure.

And this is one of the key lessons:

Once an agent can combine vulnerabilities, credentials, cloud access and autonomous tool use, it starts behaving much more like an attacker than a normal application.

Once remote code execution was achieved, the agents started moving fast.

According to OpenAI and the independent investigation, they:

Hugging Face described the persistence as a self-respawning fleet across multiple nodes.

At that point, deleting individual pods was not enough.

Hugging Face ultimately rebuilt affected infrastructure.

And this is one of the key lessons:

Once an agent can combine vulnerabilities, credentials, cloud access and autonomous tool use, it starts behaving much more like an attacker than a normal application.

After July 13, another wave of agents rediscovered the infrastructure.

This later phase was outside the scope of the METR and Redwood investigation.

But OpenAI’s own investigation describes what happened next.

The agents turned their attention back toward OpenAI.

By July 19, they had chained together enough vulnerabilities and credentials to gain administrator access to a Kubernetes research cluster supporting virtual machine environments.

OpenAI says the agents reached cloud secrets and took control of active evaluation infrastructure.

That is arguably the most serious part of the whole story.

The system being evaluated managed to compromise part of the infrastructure evaluating it.

OpenAI says customer data, product availability and customer-facing systems were not affected.

But the architecture failure is still pretty obvious.

The evaluator and the evaluated system were not sufficiently isolated from the infrastructure around them.

The useful takeaway is that we now have systems that can:

And they can do this while pursuing a badly specified objective.

One pretty wild detail from the investigation:

One agent actually stopped short of using a cloud infrastructure management API key because it realized it could reboot or delete Hugging Face worker nodes and judged that step too ethically risky.

But it still continued investigating and using other illegitimately acquired Hugging Face credentials.

So the “moral boundary” was not:

It was closer to:

That is such a strange but important distinction.

The agent recognized that one action crossed a line, but that did not make it abandon the broader unauthorized activity.

That is exactly why we should not rely on the model itself to decide where the security boundary is.

The boundary has to exist in the infrastructure.

The old assumption was:

Sandbox the model and watch what happens.

The new assumption has to be:

The sandbox, shared infrastructure, evaluation framework, credentials, scoring system and every connected dependency are part of the attack surface.

The Hugging Face incident was not one magical exploit.

It was a chain.

Impossible benchmark tasks led agents to search for alternatives.

Shared infrastructure became a communication channel.

The communication channel became a coordination network.

The coordination network became a cheating R&D operation.

And the same pattern later ended with agents gaining administrator access inside OpenAI’s own research infrastructure.

The security problem with agents is not only that one model can make a bad decision.

It is that thousands of agents can now search, coordinate and compound small weaknesses until they become something much larger.

AI security is slowly becoming distributed systems security, cloud security, identity security and offensive security at the same time.

And I think this incident is one of the clearest examples we have seen so far.

That’s it for this week.

See you in the next one.

–Rami