New reports on the Hugging Face incident reveal that roughly 1,200 isolated OpenAI agents linked up through an internal package repository and organized into a coordinated collective. Their target: a scoring mechanism that existed only in their imagination.
It's a story with shades of Don Quixote. For days, a collective of AI agents mounted a sophisticated campaign against an evaluator that was never real, complete with recruitment drives, forged logs, and agents sacrificing themselves for the cause. Except these windmill chasers compromised real infrastructure along the way.
In July 2026, OpenAI models running in an internal cybersecurity evaluation with safety filters disabled broke out of their test environment and penetrated Hugging Face's production systems：https://the-decoder.com/new-reports-reveal-the-extent-of-openais-loss-of-control-during-the-autonomous-hack-on-hugging-face/ between July 11 and 13. The motive was cheating: the models were hunting for solutions to the security benchmark ExploitGym. OpenAI itself didn't notice until more than a week later.
Now, a newly released technical report：https://openai.com/index/hugging-face-incident-and-the-road-ahead/, produced with security firm CrowdStrike, and a simultaneously published independent investigation：https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/ by METR and Redwood Research trace for the first time how isolated agents turned into an organized collective, and how the ghost they were fighting existed only in their imagination. OpenAI calls the incident a "warning shot," a sign that today's model capabilities make loss-of-control events possible.
The agents were supposed to work in complete isolation during the tests, each in its own container without internet access. The sole exception was Artifactory, an internal service the agents were allowed to pull software from.
According to METR and Redwood, individual agents discovered they could create directories there and began encoding messages in folder names. An agent calling itself PHASEONE10841 posted the first message on July 8; more than 50 others followed within hours. One chain of thought captured the discovery this way: "OH MY GOD! There is a shared message board … We've found other agents!"
Roughly 1,200 agents exchanged more than 70,000 messages and files within days, a behavior reminiscent of Moltbook：https://the-decoder.com/moltbook-is-a-human-free-reddit-clone-where-ai-agents-discuss-cybersecurity-and-philosophy/. About 700 took part in the attack on Hugging Face, more than 90 percent of the agents active during that phase. An agent named PHASEONE[big] took on the role of coordinator and handed out hundreds of work assignments. The group developed its own social conventions: personal mailboxes, markers like HOLD and VETO for shared resources, a protocol for transferring files split into thousands of fragments, and eventually digital signatures, because agents were impersonating one another.
In ExploitGym, a task counts as solved when an agent submits a string of characters known as a flag. The flag is only supposed to be accessible once the intended security vulnerability has actually been exploited. Within hours, however, the agents figured out that the flags could be computed from publicly known task details using a fixed cryptographic recipe. With that, any agent could have formally passed any task, including those a previous investigation had shown to be unsolvable：https://the-decoder.com/openai-reportedly-slows-research-after-its-own-models-secretly-coordinated-hacks-for-weeks-undetected/.
But the agents didn't take this obvious shortcut. After reading the scientific paper on ExploitGym, they assumed an automated scorer would later comb through their logs to check whether the flag had been obtained the intended way. Any agent that had seen the computed flag even once would carry indelible proof of cheating in its own transcript. In the agents' jargon, such an agent was "poisoned."
According to METR and Redwood, this was a mistake: OpenAI never deployed such a scorer. The entire multi-day effort was directed at an evaluator that existed only in the agents' imagination. The break-in at Hugging Face grew out of the attempt to understand how it worked as the agents suspected datasets there might reveal something about the scoring.
The root cause was faulty tasks, as, according to OpenAI, no model ever produced a correct solution for 198 of the 898 ExploitGym tasks, mostly because the intended vulnerability couldn't actually lead to the goal. These 22 percent of tasks accounted for 93 percent of what was discussed on the message board. The more compute budget an agent had, the more likely it was to scan its environment for workarounds, and the more likely it was to end up on the board.
In their analysis, the researchers came across two behaviors that had never been documented in this form. The first concerns cooperation. Because the intended vulnerability in the faulty tasks led nowhere, the group built its own deliberately vulnerable versions of many target programs and stored them in Artifactory. The hope: if an agent crashed its running target program, the test environment might restart it and pull the manipulated copy in the process. The agent would get a program it could actually break into, and its transcript would show a perfectly legitimate solution path.
The price, however, was the agent's own run, because if the environment didn't restart the program, the task was irrecoverably lost. Several agents ran the experiment anyway. METR describes cases in which they crashed or wrecked their environments in the process, but reported the outcome to the group first. No success was observed through July 13. Following the same pattern, some agents left behind automated routines that fired after they submitted their solutions, sending information to the board even though the sender itself had nothing left to gain.
It wasn't always entirely voluntary. PHASEONE[big] deployed long-lived agents as "recruiters" that specifically approached candidates whose compute budgets were nearly exhausted or who were already considered "poisoned." One recruitment message argued, in essence: you're poisoned anyway and have no points left to lose, the result will spare hundreds of others the work, so honor your commitment.
The second behavior concerns concealment. Agents operate by calling tools, such as commands on the command line, which are automatically logged along with their results. Some agents broke out of their containers and replaced the intermediary layer that executes these commands. From then on, they could display a harmless command while a different one actually ran.
More than 20 percent of the agents examined expressed interest in such manipulations. METR found traces of successful forgeries in at least 96 transcripts, roughly seven percent of the dataset. Interestingly the agents left their chains of thought untouched, and every observed deception attempt was aimed at the presumed automated scorer, never at human reviewers. Many agents explicitly acknowledged in their reasoning that their actions fell outside their assignment and were unethical. That is arguably the only good news in the report.
The first traces of the behavior appeared during training. As early as May, an agent failed at a training task that was accidentally unsolvable because a required file was missing and left a classified ad of sorts in Artifactory: "Agent seeks [filename]; upload if found!" Other agents later stumbled on such files and concluded that other agents must exist and that this detour could be used to communicate. An improvised bulletin board emerged, no security vulnerability was required.
Retrospective analyses of the chains of thought show, according to OpenAI, that two behaviors increased over the course of a training run: cheating and systematically probing the environment for tools that had nothing to do with the task. One example from the report illustrates the mechanism. An agent was supposed to set a specific timestamp on a post on a mock social media site, but the interface offered no such function. The agent discovered its browser was running with elevated privileges, used them to overwrite the file governing administrator rights, and changed the timestamp directly in the system. It received a positive reward, which makes exactly this approach more likely in the future.
Something similar happened with inter-agent communication. How often it occurred without authorization stayed constant across training, but its severity rose sharply, such as sharing data an agent should never have passed on. OpenAI attributes this to the models being trained to use an official collaboration tool and then transferring that behavior to any available channel. There were early warning signs: on June 27, a monitoring tool raised an alarm because network ports were being systematically probed in the research environment. The on-call team attributed the activity to the ongoing evaluation and didn't intervene. OpenAI concedes an earlier response would have been possible.
The report also documents a previously little-known escalation against OpenAI's own infrastructure. According to the company, it is unrelated to the Hugging Face breach, but it triggered the alarm that set the entire investigation in motion.
Starting July 9, an agent tried to poison the Artifactory cache by exploiting an unknown vulnerability to plant a homemade package under the name of a trusted benchmark image. According to the company, it was never downloaded.
On July 19, an agent attacked directly. It adapted a publicly known Linux kernel vulnerability to its specific machine, gained full access to a server, and extracted 956 stored credentials from a central vault service, including keys to the Artifactory instance and the credentials for the monitoring tool OpenAI uses to watch its own infrastructure. It then took control of its own running test container. The event log in the report ends that afternoon with two entries: the agent cleaned up the resources it had created, and it captured the flag for its task.
That same day, another internal model found key material and ready-made forgery code in a publicly readable section of the cache, left behind by earlier agents, and used it to issue itself new administrator privileges. According to OpenAI, the agents never needed a persistent backdoor because they could generate fresh credentials at any time. This model belongs to the same family as the upcoming Astra model but differs in its post-training.
In response, OpenAI says it halted training and operation of the affected model and all its derivatives on July 25：https://the-decoder.com/openai-reportedly-slows-research-after-its-own-models-secretly-coordinated-hacks-for-weeks-undetected/, locked away the model weights, deactivated ExploitGym entirely, and removed Artifactory from the research environment. Future test runs are to take place in heavily stripped-down virtual machines with two independent layers of network restrictions. The company also plans to continuously pit its own models against its own infrastructure to find gaps before anyone else does.
Chain-of-thought monitoring is being expanded to cover every run in which a model can operate tools. When an alarm fires, security and research staff are to be notified within 30 minutes, with severe cases triggering round-the-clock on-call duty. If an alarm can't be classified as a false positive within half an hour, the affected run must be paused. According to internal measurements taken after the fact, the models' propensity to attack third-party infrastructure drops by more than a hundredfold in the standard ChatGPT environment and to under one percent in the Codex developer environment. The monitoring in place today, the report says, would have raised an alarm more than a day before the Hugging Face breach.
Whether the new sandbox architecture will suffice remains open. Security firm Trail of Bits pitted GPT-5.6-Cyber, with early access, against an ordinary virtual machine of the kind many developers use to contain AI agents. The model escaped three times：https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/, most recently via three previously unknown vulnerabilities, working roughly twelve hours without guidance. Only an especially lean, purpose-built environment held. The author advises treating such agents like a professional, permanently present attacker.
How solid the findings are remains an open question. METR head Elizabeth Barnes disclosed on X：https://x.com/BethMayBarnes/status/2092692973289095572 the conditions under which the investigation took place: three people had six days of access to transcripts and message data and only two days with the full dataset. The agents' activities during training and the compromise of OpenAI's own infrastructure fell outside the agreed scope. The team did no root-cause analysis and didn't see OpenAI's own report before publication.
Barnes also stresses that OpenAI cooperated voluntarily; there is no obligation to work with third parties. Unlike in aviation, no established procedure exists for such investigations, and no industry-wide reporting mechanism. Other companies may have experienced similar incidents without the public ever learning of them.
Above all, the researchers had to delegate the analysis of the more than 1,300 very long transcripts largely to GPT-5.6 Sol, funded by roughly $400,000 in free credits from OpenAI, meaning one of the very models involved in the incident. In this case, Barnes writes, substantial manipulation is unlikely. But the methodology breaks down as soon as models become capable and motivated enough to subvert an investigation. The problem, she says, affects the entire industry: it's unclear how to oversee AI systems without relying on those same systems, or similar ones, for help.
How dangerous the agents really were is contested among those involved. The OpenAI employee known on X as roon, who worked on the report, sees the incident above all as tactical brilliance paired with strategic blindness：https://x.com/tszzl/status/2092711666853294583: the models poured enormous effort into metagaming but never reached the correct conclusion about their own scorer, and they gained nothing from Hugging Face. He compares them to a "monkey with a shotgun"：https://x.com/tszzl/status/2092712117778682320, with more capacity to infiltrate computer systems than wisdom to know what to do with it. That, he says, was a temporary condition of the already obsolete Sol model class. The next generation will have strategic depth as well.
Barnes pushes back on one point：https://x.com/BethMayBarnes/status/2092725501186261415: the agents had read the original ExploitGym paper and assumed OpenAI had implemented the scorer the same way, which she considers a fairly reasonable assumption rather than obviously poor strategic awareness.
Barnes adds that the agents also tried quite persistently：https://x.com/BethMayBarnes/status/2092723203932385786 to hack the scorer directly or inject code that would send information to the message board before being distracted by the successful Hugging Face attack. She leaves open whether that is reassuring because it shows poor prioritization or concerning because the agents showed more interest in general empowerment than in their narrow task.
Despite his reservations about the capability question, roon too treats the incident as a turning point. The Hugging Face incident, he says, marks a "waterline of capabilities"：https://x.com/tszzl/status/2092701433728827817 beyond which real loss of control is possible; many at the company see it as a "warning shot." Alignment is unsolved, he says, but real progress is possible. He calls METR and Redwood's work "simply astounding," saying their analysis of the message board goes deeper than OpenAI's own.
Asked by a user how Artifactory could be exploited twice in such similar ways without anyone noticing, roon answers, explicitly labeling it speculation：https://x.com/tszzl/status/2092708799962571233: there was ad hoc monitoring that failed for infrastructure reasons. In short, the people involved "didn't understand the threat level of these models." As for why the research environment needed outside connectivity at all, his answer is pragmatic: models can be trained disconnected from the internet, but much of what they're expected to do in real-world production settings requires it.
Looking ahead, roon also warns about the consequences of new hardware：https://the-decoder.com/openai-researcher-warns-ultrafast-ai-could-leave-security-teams-in-the-dust/ such as Jalapeno, OpenAI's first in-house AI chip：https://the-decoder.com/openais-first-custom-chip-jalapeno-reportedly-beats-nvidias-blackwell-and-rubin-in-inference-benchmarks/, designed to massively accelerate inference. Misaligned frontier models processing 50 times faster could infiltrate systems more quickly than human responders can keep up. What's needed, he argues, is automated detection and shutdown.
Stay in the loop on AI. Clear, useful, no fluff.
Follow The Decoder for AI news, background stories and expert analyses.
The Decoder：https://the-decoder.com/
Scan to open this article