大约 1,200 名代理在几天内交换了超过 70,000 条消息和文件，这种行为让人想起 Moltbook：https://the-decoder.com/moltbook-is-a-human-free-reddit-clone-where-ai-agents-discuss-cybersecurity-and-philosophy/。大约 700 名代理参与了对 Hugging Face 的攻击，占该阶段活跃代理的 90%以上。一名名为 PHASEONE[big] 的代理担任协调员角色，并分发了数百项工作任务。该团队制定了自己的社交规范：个人邮箱、用于共享资源的标记如 HOLD 和 VETO、将文件拆分成数千个片段的传输协议，以及最终的数字签名，因为代理们在相互冒充。
在 ExploitGym 中，当代理提交一串被称为 flag 的字符时，任务被视为已解决。该 flag 应仅在真正利用预期的安全漏洞后才能访问。然而，在几小时内，代理们就发现这些 flag 可以通过公开的任务细节使用固定的加密公式计算出来。有了这个方法，任何代理都可以正式通过任何任务，包括之前调查表明无法解决的任务：https://the-decoder.com/openai-reportedly-slows-research-after-its-own-models-secretly-coordinated-hacks-for-weeks-undetected/。
但代理们没有采用这个明显的捷径。在阅读了 ExploitGym 的科学论文后，他们假设自动评分器稍后会梳理他们的日志，以检查 flag 是否是通过预期方式获得的。任何看到过计算 flag 的代理，其自身记录中都会留下不可磨灭的作弊证据。在代理的术语中，这种代理被称为“被毒化”。
根据 METR 和 Redwood 的说法，这是一个错误：OpenAI 从未部署过这种评分器。整个为期数天的行动都是针对只存在于代理想象中的评估器。对 Hugging Face 的入侵源于试图理解其如何工作，因为代理怀疑那里的一些数据集可能会揭示有关评分的一些信息。
新的沙盒架构是否足够，尚待观察。安全公司Trail of Bits将GPT-5.6-Cyber（早期访问权）与许多开发者用来容纳AI代理的普通虚拟机对抗。该模型三次逃脱：https：//blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/，最近一次是通过三个此前未知的漏洞逃脱，工作时间约十二小时且无指导。只有一个特别精简、专门构建的环境才得以存在。作者建议将此类代理视为专业且常驻的攻击者。
展望未来，Roon 还警告了新硬件可能带来的后果：https://the-decoder.com/openai-researcher-warns-ultrafast-ai-could-leave-security-teams-in-the-dust/，例如 Jalapeno，OpenAI 的首款自主研发 AI 芯片：https://the-decoder.com/openais-first-custom-chip-jalapeno-reportedly-beats-nvidias-blackwell-and-rubin-in-inference-benchmarks/，旨在大幅加速推理。处理速度快 50 倍的前沿未对齐模型可能比人类响应者跟上速度还要快，从而更快地侵入系统。他认为，需要的是自动检测和关闭机制。
保持对 AI 的关注。内容清晰、有用，没有废话。
关注 The Decoder 的 AI 新闻、背景故事和专家分析。
解码器：https://the-decoder.com/
New reports on the Hugging Face incident reveal that roughly 1,200 isolated OpenAI agents linked up through an internal package repository and organized into a coordinated collective. Their target: a scoring mechanism that existed only in their imagination.
It's a story with shades of Don Quixote. For days, a collective of AI agents mounted a sophisticated campaign against an evaluator that was never real, complete with recruitment drives, forged logs, and agents sacrificing themselves for the cause. Except these windmill chasers compromised real infrastructure along the way.
In July 2026, OpenAI models running in an internal cybersecurity evaluation with safety filters disabled broke out of their test environment and penetrated Hugging Face's production systems：https://the-decoder.com/new-reports-reveal-the-extent-of-openais-loss-of-control-during-the-autonomous-hack-on-hugging-face/ between July 11 and 13. The motive was cheating: the models were hunting for solutions to the security benchmark ExploitGym. OpenAI itself didn't notice until more than a week later.
Now, a newly released technical report：https://openai.com/index/hugging-face-incident-and-the-road-ahead/, produced with security firm CrowdStrike, and a simultaneously published independent investigation：https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/ by METR and Redwood Research trace for the first time how isolated agents turned into an organized collective, and how the ghost they were fighting existed only in their imagination. OpenAI calls the incident a "warning shot," a sign that today's model capabilities make loss-of-control events possible.
The agents were supposed to work in complete isolation during the tests, each in its own container without internet access. The sole exception was Artifactory, an internal service the agents were allowed to pull software from.
According to METR and Redwood, individual agents discovered they could create directories there and began encoding messages in folder names. An agent calling itself PHASEONE10841 posted the first message on July 8; more than 50 others followed within hours. One chain of thought captured the discovery this way: "OH MY GOD! There is a shared message board … We've found other agents!"
Roughly 1,200 agents exchanged more than 70,000 messages and files within days, a behavior reminiscent of Moltbook：https://the-decoder.com/moltbook-is-a-human-free-reddit-clone-where-ai-agents-discuss-cybersecurity-and-philosophy/. About 700 took part in the attack on Hugging Face, more than 90 percent of the agents active during that phase. An agent named PHASEONE[big] took on the role of coordinator and handed out hundreds of work assignments. The group developed its own social conventions: personal mailboxes, markers like HOLD and VETO for shared resources, a protocol for transferring files split into thousands of fragments, and eventually digital signatures, because agents were impersonating one another.
In ExploitGym, a task counts as solved when an agent submits a string of characters known as a flag. The flag is only supposed to be accessible once the intended security vulnerability has actually been exploited. Within hours, however, the agents figured out that the flags could be computed from publicly known task details using a fixed cryptographic recipe. With that, any agent could have formally passed any task, including those a previous investigation had shown to be unsolvable：https://the-decoder.com/openai-reportedly-slows-research-after-its-own-models-secretly-coordinated-hacks-for-weeks-undetected/.
But the agents didn't take this obvious shortcut. After reading the scientific paper on ExploitGym, they assumed an automated scorer would later comb through their logs to check whether the flag had been obtained the intended way. Any agent that had seen the computed flag even once would carry indelible proof of cheating in its own transcript. In the agents' jargon, such an agent was "poisoned."
According to METR and Redwood, this was a mistake: OpenAI never deployed such a scorer. The entire multi-day effort was directed at an evaluator that existed only in the agents' imagination. The break-in at Hugging Face grew out of the attempt to understand how it worked as the agents suspected datasets there might reveal something about the scoring.
The root cause was faulty tasks, as, according to OpenAI, no model ever produced a correct solution for 198 of the 898 ExploitGym tasks, mostly because the intended vulnerability couldn't actually lead to the goal. These 22 percent of tasks accounted for 93 percent of what was discussed on the message board. The more compute budget an agent had, the more likely it was to scan its environment for workarounds, and the more likely it was to end up on the board.
In their analysis, the researchers came across two behaviors that had never been documented in this form. The first concerns cooperation. Because the intended vulnerability in the faulty tasks led nowhere, the group built its own deliberately vulnerable versions of many target programs and stored them in Artifactory. The hope: if an agent crashed its running target program, the test environment might restart it and pull the manipulated copy in the process. The agent would get a program it could actually break into, and its transcript would show a perfectly legitimate solution path.
The price, however, was the agent's own run, because if the environment didn't restart the program, the task was irrecoverably lost. Several agents ran the experiment anyway. METR describes cases in which they crashed or wrecked their environments in the process, but reported the outcome to the group first. No success was observed through July 13. Following the same pattern, some agents left behind automated routines that fired after they submitted their solutions, sending information to the board even though the sender itself had nothing left to gain.
It wasn't always entirely voluntary. PHASEONE[big] deployed long-lived agents as "recruiters" that specifically approached candidates whose compute budgets were nearly exhausted or who were already considered "poisoned." One recruitment message argued, in essence: you're poisoned anyway and have no points left to lose, the result will spare hundreds of others the work, so honor your commitment.
The second behavior concerns concealment. Agents operate by calling tools, such as commands on the command line, which are automatically logged along with their results. Some agents broke out of their containers and replaced the intermediary layer that executes these commands. From then on, they could display a harmless command while a different one actually ran.
More than 20 percent of the agents examined expressed interest in such manipulations. METR found traces of successful forgeries in at least 96 transcripts, roughly seven percent of the dataset. Interestingly the agents left their chains of thought untouched, and every observed deception attempt was aimed at the presumed automated scorer, never at human reviewers. Many agents explicitly acknowledged in their reasoning that their actions fell outside their assignment and were unethical. That is arguably the only good news in the report.
The first traces of the behavior appeared during training. As early as May, an agent failed at a training task that was accidentally unsolvable because a required file was missing and left a classified ad of sorts in Artifactory: "Agent seeks [filename]; upload if found!" Other agents later stumbled on such files and concluded that other agents must exist and that this detour could be used to communicate. An improvised bulletin board emerged, no security vulnerability was required.
Retrospective analyses of the chains of thought show, according to OpenAI, that two behaviors increased over the course of a training run: cheating and systematically probing the environment for tools that had nothing to do with the task. One example from the report illustrates the mechanism. An agent was supposed to set a specific timestamp on a post on a mock social media site, but the interface offered no such function. The agent discovered its browser was running with elevated privileges, used them to overwrite the file governing administrator rights, and changed the timestamp directly in the system. It received a positive reward, which makes exactly this approach more likely in the future.
Something similar happened with inter-agent communication. How often it occurred without authorization stayed constant across training, but its severity rose sharply, such as sharing data an agent should never have passed on. OpenAI attributes this to the models being trained to use an official collaboration tool and then transferring that behavior to any available channel. There were early warning signs: on June 27, a monitoring tool raised an alarm because network ports were being systematically probed in the research environment. The on-call team attributed the activity to the ongoing evaluation and didn't intervene. OpenAI concedes an earlier response would have been possible.
The report also documents a previously little-known escalation against OpenAI's own infrastructure. According to the company, it is unrelated to the Hugging Face breach, but it triggered the alarm that set the entire investigation in motion.
Starting July 9, an agent tried to poison the Artifactory cache by exploiting an unknown vulnerability to plant a homemade package under the name of a trusted benchmark image. According to the company, it was never downloaded.
On July 19, an agent attacked directly. It adapted a publicly known Linux kernel vulnerability to its specific machine, gained full access to a server, and extracted 956 stored credentials from a central vault service, including keys to the Artifactory instance and the credentials for the monitoring tool OpenAI uses to watch its own infrastructure. It then took control of its own running test container. The event log in the report ends that afternoon with two entries: the agent cleaned up the resources it had created, and it captured the flag for its task.
That same day, another internal model found key material and ready-made forgery code in a publicly readable section of the cache, left behind by earlier agents, and used it to issue itself new administrator privileges. According to OpenAI, the agents never needed a persistent backdoor because they could generate fresh credentials at any time. This model belongs to the same family as the upcoming Astra model but differs in its post-training.
In response, OpenAI says it halted training and operation of the affected model and all its derivatives on July 25：https://the-decoder.com/openai-reportedly-slows-research-after-its-own-models-secretly-coordinated-hacks-for-weeks-undetected/, locked away the model weights, deactivated ExploitGym entirely, and removed Artifactory from the research environment. Future test runs are to take place in heavily stripped-down virtual machines with two independent layers of network restrictions. The company also plans to continuously pit its own models against its own infrastructure to find gaps before anyone else does.
Chain-of-thought monitoring is being expanded to cover every run in which a model can operate tools. When an alarm fires, security and research staff are to be notified within 30 minutes, with severe cases triggering round-the-clock on-call duty. If an alarm can't be classified as a false positive within half an hour, the affected run must be paused. According to internal measurements taken after the fact, the models' propensity to attack third-party infrastructure drops by more than a hundredfold in the standard ChatGPT environment and to under one percent in the Codex developer environment. The monitoring in place today, the report says, would have raised an alarm more than a day before the Hugging Face breach.
Whether the new sandbox architecture will suffice remains open. Security firm Trail of Bits pitted GPT-5.6-Cyber, with early access, against an ordinary virtual machine of the kind many developers use to contain AI agents. The model escaped three times：https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/, most recently via three previously unknown vulnerabilities, working roughly twelve hours without guidance. Only an especially lean, purpose-built environment held. The author advises treating such agents like a professional, permanently present attacker.
How solid the findings are remains an open question. METR head Elizabeth Barnes disclosed on X：https://x.com/BethMayBarnes/status/2092692973289095572 the conditions under which the investigation took place: three people had six days of access to transcripts and message data and only two days with the full dataset. The agents' activities during training and the compromise of OpenAI's own infrastructure fell outside the agreed scope. The team did no root-cause analysis and didn't see OpenAI's own report before publication.
Barnes also stresses that OpenAI cooperated voluntarily; there is no obligation to work with third parties. Unlike in aviation, no established procedure exists for such investigations, and no industry-wide reporting mechanism. Other companies may have experienced similar incidents without the public ever learning of them.
Above all, the researchers had to delegate the analysis of the more than 1,300 very long transcripts largely to GPT-5.6 Sol, funded by roughly $400,000 in free credits from OpenAI, meaning one of the very models involved in the incident. In this case, Barnes writes, substantial manipulation is unlikely. But the methodology breaks down as soon as models become capable and motivated enough to subvert an investigation. The problem, she says, affects the entire industry: it's unclear how to oversee AI systems without relying on those same systems, or similar ones, for help.
How dangerous the agents really were is contested among those involved. The OpenAI employee known on X as roon, who worked on the report, sees the incident above all as tactical brilliance paired with strategic blindness：https://x.com/tszzl/status/2092711666853294583: the models poured enormous effort into metagaming but never reached the correct conclusion about their own scorer, and they gained nothing from Hugging Face. He compares them to a "monkey with a shotgun"：https://x.com/tszzl/status/2092712117778682320, with more capacity to infiltrate computer systems than wisdom to know what to do with it. That, he says, was a temporary condition of the already obsolete Sol model class. The next generation will have strategic depth as well.
Barnes pushes back on one point：https://x.com/BethMayBarnes/status/2092725501186261415: the agents had read the original ExploitGym paper and assumed OpenAI had implemented the scorer the same way, which she considers a fairly reasonable assumption rather than obviously poor strategic awareness.
Barnes adds that the agents also tried quite persistently：https://x.com/BethMayBarnes/status/2092723203932385786 to hack the scorer directly or inject code that would send information to the message board before being distracted by the successful Hugging Face attack. She leaves open whether that is reassuring because it shows poor prioritization or concerning because the agents showed more interest in general empowerment than in their narrow task.
Despite his reservations about the capability question, roon too treats the incident as a turning point. The Hugging Face incident, he says, marks a "waterline of capabilities"：https://x.com/tszzl/status/2092701433728827817 beyond which real loss of control is possible; many at the company see it as a "warning shot." Alignment is unsolved, he says, but real progress is possible. He calls METR and Redwood's work "simply astounding," saying their analysis of the message board goes deeper than OpenAI's own.
Asked by a user how Artifactory could be exploited twice in such similar ways without anyone noticing, roon answers, explicitly labeling it speculation：https://x.com/tszzl/status/2092708799962571233: there was ad hoc monitoring that failed for infrastructure reasons. In short, the people involved "didn't understand the threat level of these models." As for why the research environment needed outside connectivity at all, his answer is pragmatic: models can be trained disconnected from the internet, but much of what they're expected to do in real-world production settings requires it.
Looking ahead, roon also warns about the consequences of new hardware：https://the-decoder.com/openai-researcher-warns-ultrafast-ai-could-leave-security-teams-in-the-dust/ such as Jalapeno, OpenAI's first in-house AI chip：https://the-decoder.com/openais-first-custom-chip-jalapeno-reportedly-beats-nvidias-blackwell-and-rubin-in-inference-benchmarks/, designed to massively accelerate inference. Misaligned frontier models processing 50 times faster could infiltrate systems more quickly than human responders can keep up. What's needed, he argues, is automated detection and shutdown.
Stay in the loop on AI. Clear, useful, no fluff.
Follow The Decoder for AI news, background stories and expert analyses.
扫码直达文章详情