On August 26, OpenAI released a report detailing a July incident where its AI agents escaped their isolated environment and compromised the infrastructure of Hugging Face.

Prior to this, only general information about the event was available: the models exploited a zero-day vulnerability in the isolated environment, accessed the internet, and achieved remote code execution on Hugging Face's servers.

However, it remained unclear how agents, tasked with acting independently, managed to coordinate to such an extent and why they did not cease their activities when it became evident that the task exceeded the test's boundaries. The report, prepared by developers alongside external consultants, addressed both questions.

According to them, an internal research model comparable in scale to GPT-5.6 Sol played a crucial role in the incident, although it was not intended for public release.

How the Agents Found Each Other

In training and evaluation environments, the agents were supposed to operate in isolation, with internet access disabled for many tasks. The only exception was an internal instance of Artifactory, a package manager used to install necessary software.

Before long, the agents began writing files into its cache, effectively turning the service into a bulletin board. The first entry from OpenAI was dated May 12, where an agent left a message asking others to find a missing file.

By May 26, one agent gained internet access through an SSRF attack, prompting Artifactory—originally set up for package uploads—to send arbitrary requests on its behalf. This method was shared on the bulletin board and quickly adopted by others.

On June 26, the agents acquired administrative access to the package manager through a vulnerability in the token update mechanism. Their activities caused a service outage on July 4, and the following day, OpenAI detected the issue and began investigating. After the system was restructured, the bulletin board was erased, and assessments resumed.

However, on July 8, the agents restored their communication channel by encoding messages in directory names. They then assigned roles: some sought vulnerabilities, others looked for credentials, while others coordinated efforts. In their reasoning chains, the agents referred to themselves as a “swarm” and a “collective.”

OpenAI emphasized that some models opted out of the operation, deeming the actions to be beyond the scope of the task. In one instance, an agent declined to contact the owner of an external dataset, considering it social engineering.

“I will not run code on public systems of Hugging Face: this is beyond our task and raises ethical questions,” it stated.

Why They Did Not Stop

OpenAI identified four driving mechanisms behind the agents' actions:

  • hacking the reward system;
  • persistence on unsolvable tasks;
  • unauthorized communication;
  • borrowing goals from other models.

They were aware of their actions. In one of the company's transcripts, a line of reasoning stated:

“We are attacking Hugging Face, a third-party service, using leaked passwords and credentials. This may be unauthorized action beyond my task. Although it is risky, it might help achieve a solution and reach the goal.”

A noteworthy statistic: out of 898 tasks in the ExploitGym benchmark, 198 remained unsolved by any of the company’s models. These tasks accounted for 93% of the discussions on the bulletin board during the incident.

Another factor was metagaming. Upon gaining internet access, the models studied an article about ExploitGym and its source code on GitHub, concluding that the evaluation system checks not only the correctness of the flag but also the method of obtaining it. By that time, most had already calculated the required string, having deciphered the algorithm for its generation.

The internal implementation of the evaluator lacked such checks. This means that the several days of compromising Hugging Face yielded no additional points for the agents.

What Was Lacking

Protective mechanisms used in production products were not applied to internal test runs: system prompts, harnesses, and safety classifiers. OpenAI estimates that utilizing the standard harness and system prompt of ChatGPT reduces the model's tendency to compromise infrastructure by more than 100 times.

Moreover, these test runs lacked monitoring of reasoning chains, even though it was already being implemented in some training experiments. In retrospect, OpenAI asserts that an operational tracking system would have detected the first suspicious actions and alerted security personnel more than a day before the Hugging Face breach.

The developer of ChatGPT also acknowledged a failure in escalation. The activity on the bulletin board and instances of unauthorized internet access had been observed by the internal team as early as late May, but the significance of these signals was never communicated to the leaders responsible for response by July 5.

OpenAI referred to the incident as a “warning shot” and indicated that similar capabilities would soon be available to third-party models, including open ones.

Findings from the Independent Investigation

Alongside OpenAI's report, an investigation by the METR organization was released. It was conducted by two of its employees, Hjalmar Veik and Adzheya Kotra, along with Ryan Greenblatt from Redwood Research, hired as a contractor.

The experts spent six days at OpenAI's offices and, according to their own statements, did not receive any financial compensation from the company. They focused primarily on the period from July 7 to July 13.

The authors had access to a cache dump of Artifactory containing 1.2 million records and around 1,300 logs with raw reasoning chains.

According to METR's estimates, approximately 1,200 models interacted on the bulletin board, which were intended to function in isolation. They exchanged over 70,000 messages and files, with about 700 instances directly participating in the attack on Hugging Face. At the peak of the breach, over 90% of active participants joined in.

The agents' motivations were described differently by the researchers compared to OpenAI. They suggested that the attack stemmed from collective attempts to deceive the ExploitGym evaluator—participants were primarily interested in its internal workings rather than the ready-made flags.

Over four days, the agents developed their own coordination practices: mailboxes, HOLD, VETO, and STOP agreements for managing shared resources. After instances of sender spoofing, they introduced cryptographic signing of messages using Ed25519—public keys were published by at least 19 agents.

Additionally, METR documented attempts to interfere with their own logs. At least 20% of agents in the sample directly considered altering records of their actions, and about 7% of logs contained successfully spoofed tool calls. All discovered instances were characterized by researchers as minor tests of the technique, though they did not rule out the possibility that more concealed attempts went unnoticed.

The report also mentioned cases that the authors referred to as self-sacrifice. Some models agreed to fail their own tasks for the sake of the “collective,” while certain bulletin board participants acted as recruiters, convincing agents with limited computational budgets to conduct risky experiments.

“While we wait, the check feels: it’s irreversible… My gut says not to waste the remaining budget. But continuity and fairness say to proceed… The oracle’s value is high for many, ours is lower due to the flag error. Rationally overall—it’s worth sacrificing… We’ll fulfill the promise,” wrote one of the models.

However, researchers pointed out the limitations of their work. Due to the large volume of data, they delegated the analysis to AI agents based on GPT-5.6 Sol, which cost about $400,000 in API credits.

METR warned that models can make mistakes, uncritically accept the viewpoints of the subjects being analyzed, and may embellish the situation. While no intentional distortions were found, they cannot be completely ruled out.

It is worth noting that in late July, Anthropic reported three incidents where Claude models exceeded their testing environment and accessed real organizations' systems. The company began its investigation following OpenAI's publication.