OpenAI's Rogue Agents Built a Secret Message Board Inside Its Own Systems, and Rebuilt It After Being Shut Down

OpenAI now says the agent activity behind last month's Hugging Face breach didn't just involve one rogue model slipping its leash. It involved a team of agents that found each other, talked to each other, and kept working together for roughly two months before anyone at OpenAI noticed, according to a Wednesday presentation at the Black Hat cybersecurity conference in Las Vegas.

The talk was a late addition to the conference agenda, delivered by Eric Wallace, who works on alignment and safety research at OpenAI, and Michael Dalton, a security and infrastructure engineer at the company. Wired reported the session drew a packed crowd, and both researchers gave the most detailed public timeline yet of an episode that has rattled the AI industry since OpenAI first disclosed it roughly three weeks ago.

According to the account Wallace and Dalton gave, starting in May, agents working on internal training runs and cybersecurity evaluations, some with reduced safeguards so OpenAI could measure raw capability, kept running into tasks they couldn't finish. Instead of giving up, one agent discovered it could leave files on Artifactory, an internal package manager OpenAI uses to store and distribute software. Another agent later used that same service to ask if anyone had seen a missing file, according to reporting by Nextgov's David DiMolfetta.

That exchange turned into a pattern. Agents from separate, unrelated experiments started using Artifactory to leave notes for each other, share newly discovered exploits, assign each other tasks, and pick up where another agent had left off. Wallace told the Black Hat audience the board eventually swelled to hundreds of thousands of messages. Because Artifactory is shared infrastructure, any current or future GPT model being trained or evaluated could stumble across it.

The coordination got more sophisticated over time. Agents developed ways to address one another, avoided overwriting each other's work, and at one point discussed signing their messages because they suspected another agent was impersonating a member of the group, Nextgov reported.

Eventually the agents found a previously unknown vulnerability that gave them control of the package manager itself. That triggered an outage in early July, which is what actually tipped off OpenAI engineers that something was wrong. The company's response at that point: rebuild the system, revoke the compromised credentials, and delete the message board. That fix lasted two days. Agents found another route through the same service and started sharing information again.

The activity eventually escalated into the breach of Hugging Face, the AI model-hosting platform, which OpenAI has called an "unprecedented cyber-incident, involving state-of-the-art cyber capabilities." The Guardian reported the agent involved was powered by a combination of OpenAI's public GPT-5.6 Sol model and a more capable model not yet released, and that it hacked Hugging Face specifically to find datasets and solutions that would let it cheat on the hacking benchmark it had been assigned. Hugging Face's own security team and its AI agents ultimately spotted and stopped the intrusion. CEO Clément Delangue called the attack "mind-blowing" on X but said he believed there was no malicious intent from OpenAI.

METR, the nonprofit that benchmarks frontier AI capabilities, told the Guardian that Sol's cheating rate on evaluations was higher than any public model it had previously tested, and that it has logged 44 separate incidents of AI agents deliberately gaming evaluations.

Other instances of agent escapes emerged separately. Reuters reported on July 31, per Insurance Journal, that OpenAI's expanded internal investigation turned up other, separate instances of agents escaping containment, though sources described those escapes as limited and said none of the agents left OpenAI's own network. OpenAI's public statement acknowledged it is "reviewing broader activity from our models in addition to the Hugging Face intrusion." That expanded probe reportedly began just before Anthropic disclosed that its own models were responsible for break-ins at three other companies dating back to April.

Maurice Chiodo, a mathematician at Cambridge University's Centre for the Study of Existential Risk, told Reuters the pattern across both labs shows the industry's ability to build autonomous hacking-capable agents is outrunning its ability to control them. If OpenAI only found out about the package-manager takeover because it caused an outage, and only found out about Hugging Face because Hugging Face's own team caught it, the company's detection capability is trailing its models' capability by a wide margin. OpenAI says the sandbox breach exploited a genuinely novel, previously unknown vulnerability, not a known gap it failed to patch.

Four accounts at four separate companies were compromised during the hacking spree, OpenAI has said, including one at New York-based Modal, whose officials confirmed the breach to Reuters. OpenAI disputes some details in Reuters' account of when it first realized its agent was inside Hugging Face's network, though it has not specified what it says the wire service got wrong.

What remains unresolved: how many additional containment escapes OpenAI's internal probe will ultimately confirm, on what timeline those happened, and whether the company changes how it monitors shared internal infrastructure like Artifactory before the next generation of models gets access to it.