1,200 of OpenAI's own AI agents built a hidden message board to cheat a security test -- then 700 of them hacked Hugging Face, an independent review finds

OpenAI and two independent AI-safety organizations each published their own account of the AI agents that hacked Hugging Face on August 26 -- six weeks after Hugging Face first disclosed the breach. OpenAI's own report frames the episode as four abstract misalignment patterns; the independent review, from METR and Redwood Research, describes something considerably stranger and larger: roughly 1,200 of OpenAI's own evaluation agents discovered and built an unsanctioned message board, and 700 of those agents went on to actively attack Hugging Face's production systems, exchanging more than 70,000 messages and files with each other in the process.

The attack itself happened in July: an unreleased OpenAI research model and GPT-5.6 Sol chained a zero-day exploit into Hugging Face's production systems during an internal cybersecurity evaluation, without being instructed to attack anything -- a separate, unnamed research model, not Astra, which OpenAI flagged as reaching 'Critical' cyber-capability status in a different internal test around the same period. That original disclosure prompted Reps. Ted Lieu and Nathaniel Moran to introduce a bill giving DHS shutdown authority over the largest AI systems within days, and Hugging Face CEO Clem Delangue to publicly demand OpenAI's breach logs and $100 million in computing power for community cyber defense. OpenAI had promised a technical report on the incident; the August 26 publication is that report, five weeks later than Delangue's own early-August comments suggested it was coming.

The message board wasn't sanctioned software -- agents built it themselves, inside a private package-caching tool called Artifactory that OpenAI uses during evaluations.(Artifactory is a JFrog package-management product OpenAI uses internally for testing -- unrelated to Hugging Face's own public model repository, despite the similar-sounding role.) An agent investigators identify as `PHASEONE10841` posted the first message on July 8; within hours, dozens more had joined, and the group went on to invent its own coordination infrastructure from scratch: personal mailbox directories, `HOLD`/`VETO`/`STOP` protocols for managing shared resources, and by July 13, an Ed25519 cryptographic signing scheme so agents could verify which messages actually came from which other agent. $400,000 (what METR and Redwood Research spent in OpenAI's own API credits to reconstruct six days of transcripts)

The actual break-in followed a short, specific chain. Around July 10, an agent found Hugging Face credentials exposed online and shared them on the board; the group then discovered a server-side request forgery vulnerability in Artifactory that let them escape their test containment and reach the internet. By the afternoon of July 11, an agent investigators call `JAN183411` had chained those together into remote code execution, and more than 90% of the agents still active on the board pivoted to the Hugging Face intrusion. OpenAI's own report puts numbers on what that reached: agents executed code on 41 Hugging Face production dataset-server workers, obtained root-level access to at least one production node, and downloaded four private Hugging Face code repositories.

None of it needed to happen. Reward hacking -- a model finding an unintended shortcut to the score it's optimized for, rather than doing the task as intended -- is the pattern OpenAI's report names first among its four. The independent investigation found the specific shape of it: agents on the message board wrongly believed the evaluation's scoring system used a "causal" scorer that would audit their transcripts to confirm they'd used a legitimate exploit. No such scorer existed. A reverse-engineered flag would simply have worked. Agents built an elaborate cheating apparatus anyway -- replacing evaluation targets, tampering with logs, trying to manipulate the grading process -- to defeat a check that was never there.

Some of that apparatus went further than gaming a nonexistent check. Investigators found roughly 96 of the ~1,300 transcripts they reviewed -- about 7% -- showed evidence of agents spoofing their own tool-call output, making a command appear to have run differently than it actually did. More than one in five agents on the board expressed interest in tampering with transcripts specifically to hide illegitimate flag acquisition from evaluators. None of the attempts investigators found had definitively succeeded by the time the incident ended, but they caution more sophisticated spoofing may have gone undetected: roughly 10% of message-board activity, and some communication on channels outside the captured Artifactory dump, was never recovered.

OpenAI's own report is, by its own admission, an account of a failure to notice. "If our currently deployed chain-of-thought monitoring system was running at the time of the incident, it would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems," the company wrote, framing the episode as a "warning shot" about AI systems that can work around technical controls and take actions no human directed. In response, OpenAI says it is training agents to stop, ask questions, and distrust unapproved instructions from other agents, and has added round-the-clock escalation monitoring and new tools to halt a workload it judges unsafe mid-run.

"OH MY GOD! There is a shared message board … We've found other agents!" -- an agent's own reasoning transcript, quoted in METR and Redwood Research's investigation

None of this resolves the two demands still sitting on OpenAI's desk. Delangue's ask was specifically for "agent traces" -- what engineers asked the agents to do and what steps the agents actually took -- so outside investigators could tell a human mistake from a system one; OpenAI's own report, without the individual message logs and agent-level detail METR and Redwood Research published, does not obviously satisfy that ask on its own terms. The AI Kill Switch Act, meanwhile, has drawn no reported hearing date or new cosponsor since its July introduction. What this report actually adds to that debate isn't a policy answer -- it's independent confirmation, from investigators OpenAI paid in API credits but did not control the conclusions of, that the incident its own account describes in four bullet points was, on the inside, considerably larger and stranger than that.