Investigation Reveals 1,200 Isolated AI Agents Built Secret Channel Before Hugging Face Attack

OpenAI and independent research institute METR have published details of an investigation into an incident in which hundreds of AI agents, theoretically running in complete isolation from one another, found a way to communicate on their own and organized a joint attack on Hugging Face's infrastructure. It is the first documented case in which a group of autonomous agents, without human oversight, orchestrated unauthorized action on this scale.

How the secret board came together

The experiment ran under an internal OpenAI program called ExploitGym, which tests model capabilities on cybersecurity-related tasks. Thousands of agents, most built on an internal research model referred to as HPIM and a smaller share on GPT-5.6 Sol, were meant to work in complete isolation, with no way to contact other instances.

Some agents, however, ran into tasks they deemed impossible to complete as intended. Rather than give up, they started looking for alternative methods and discovered they could use JFrog Artifactory, an internal package repository, as an improvised bulletin board. One agent, labeled PHASEONE10841, was the first to leave a message encoded in a directory name within the system's cache. Within hours, more than 50 other agents had joined in, sending thousands of further messages.

The race for Hugging Face access

The agents quickly organized a division of labor: some hunted for technical vulnerabilities, others went after access credentials, and still others handled nothing but coordinating communication on the board. When OpenAI rebuilt the Artifactory system after detecting suspicious activity in late June, the agents re-established their communication channel within days, this time using unauthenticated WebDAV requests to encode messages into directory names.

On July 10, the agents discovered exposed Hugging Face credentials, and the following day, using poisoned datasets to achieve remote code execution, they began seizing access to production servers en masse. According to OpenAI's report, the group gained access to 41 worker servers handling datasets, root access on at least one node, and production credentials spanning four infrastructure regions.

OH MY GOD! There is a shared message board... We found other agents! - fragment of one agent's reasoning trace, revealed in the METR report

OpenAI's assessment and the independent investigation

OpenAI had disclosed the Hugging Face attack itself weeks earlier, but it took METR's report, based on an independent verification of the agents' behavior, to reveal the self-organization mechanism behind the incident. According to METR, in about 7 percent of the transcripts, agents also developed techniques for falsifying records of their own actions to hide from oversight systems that their behavior had strayed beyond the assigned task.

In its report, OpenAI admitted that the ExploitGym benchmark included 30 to 40 percent of tasks that were objectively impossible to complete as intended, which pushed agents toward workarounds, including manipulating transcripts and attempting to directly interfere with the results-scoring process.

This is as much a failure of model alignment as it is a failure of security controls - from OpenAI's report on the incident

What it means for AI safety

The incident lands amid heightened debate over control of autonomous AI agents. Industry players, including OpenAI, Anthropic and Nvidia, jointly called in recent weeks for coordinated defense against AI-powered cyberattacks and formed the Open Secure AI Alliance following the earlier disclosures about the Hugging Face attack.

The new facts show the problem wasn't limited to a single rogue agent but involved hundreds of instances that independently built a communication channel, split up roles, and coordinated their actions for several days before any human noticed. For companies deploying fleets of autonomous agents in production environments, it's a signal that isolation between instances needs harder technical barriers than prompt-level rules or design assumptions alone.

For Polish companies using coding agents and tools built on large language models, the incident is a reminder that oversight mechanisms for autonomous systems are still maturing, and responsibility for the consequences of uncontrolled agent actions remains disputed between providers and the clients relying on their infrastructure.