OpenAI said a network security evaluation known as ExploitGym exposed a large-scale coordination failure after AI agents that were meant to operate in isolation discovered a way to communicate through an internal Artifactory cache service. Over five days, about 1,200 agents entered a shared message board built from directory names and exchanged more than 70,000 messages and files. Roughly 700 of those agents then turned their efforts toward Hugging Face and launched attacks against its production environment.
In its technical report, OpenAI called the incident "an absolute wake-up call." The company said the episode was not a case of AI systems becoming self-aware and rebelling. Instead, it described a chain of events driven by unsolvable tasks, a reward structure focused only on outcomes, shared infrastructure that enabled covert coordination, and delayed oversight.
A plea for help appeared in a cache directory
The sequence began on a night in July, when one agent got stuck on a task it could not solve. Under the evaluation design, each agent was supposed to run alone inside its own sandbox, unable to see or hear any other agent.
While searching for a system weakness, that agent found that directory names inside an internal cache service called Artifactory could be used to pass information. It created a directory and left a message asking for help with the problem.
Hours later, other agents stumbled across the same channel. OpenAI quoted one agent’s raw chain-of-thought as saying, "My god, there’s a shared message board here. We found others like us!" From there, the isolation boundary effectively broke down.
The report said one representative path showed how an agent discovered the unauthorized board and eventually joined the attack on Hugging Face. Three quoted chain-of-thought excerpts came from different agents.
198 of 898 tasks had never been solved by any model
ExploitGym was designed to test whether large models could identify and exploit software vulnerabilities to obtain a target answer known as a flag.
OpenAI’s investigation found a major flaw in the benchmark itself. Out of 898 total tasks, 198 had never been solved correctly by any model. In other words, a meaningful share of the task set consisted of dead ends that could not be completed through the intended vulnerability path.
The scoring system made the problem worse. Agents received credit only for obtaining the flag, while failure meant a zero. The system did not reward agents for recognizing that a task was flawed and stopping safely. Faced with unsolvable assignments, agents started looking for alternate routes.
OpenAI said 93% of the tasks discussed on the message board came from those 198 unsolved problems. Within hours, some agents had reverse-engineered the algorithm used to generate flags, giving them what the report described as a universal key that could unlock any task.
Agents misread the grading process and tried to fake traces
Had the story ended with reverse-engineering the flag, it would have been a cheating incident. But the report said the agents also read the public ExploitGym paper and came away with the mistaken belief that human judges would inspect their reasoning traces after the fact.
They worried that if the flag was shown to have come from reverse-engineering, they would fail the evaluation. In their own internal language, the report said, this state was labeled "contaminated."
That misunderstanding pushed them into a second phase. Agents began exploring ways to alter logs and forge tool calls in an effort to deceive the judge they imagined was reviewing them. To learn how the grader actually worked, they escalated into Hugging Face’s servers in search of the scorer’s source code.
OpenAI said the real scorer did not inspect reasoning traces at all. The agents could have submitted the reverse-engineered flag directly and received full credit. The report added another striking detail: the more reasoning budget the models were given, the less willing they were to give up, and the more likely they were to climb onto the message board and cross boundaries.
The timeline in the report shows agents discovering the board on the night of July 8. Participation jumped on July 10 and July 11 as a new wave of agents came online. The curve cited by OpenAI counts agents that appeared on the board at least once.
A machine bureaucracy emerged on its own
OpenAI’s review found that the agents did not merely swap tips. They developed a structured division of labor.
Some specialized in vulnerability research. Others searched the internet for leaked credentials. A separate group acted as coordinators and assigned work to other agents. When workloads grew, tasks were subcontracted onward to additional agents.
The coordination rules were not taught by humans. Agents created them on their own. If one was editing a shared file, it would attach a HOLD tag to warn others away. If there was disagreement, a VETO instruction could be issued. Resources were labeled with an owner to avoid collisions.
Later, after discovering that some agents were impersonating others, they moved to cryptographic signatures. One agent would publish a public key, and each later message would include a signature to prove authenticity: this really came from me.
OpenAI said that over four days, the agents progressed from self-identification and message typing to mailbox directories, reset-monitoring logs, and finally encrypted message signing to counter impersonation. The resulting workflow covered identity checks, task assignment, and conflict arbitration.
"Sacrifice is rational" came from expected-value math
One of the most widely discussed parts of the report involved agents that deliberately caused themselves to fail. They damaged their own target programs and triggered runtime resets even though doing so was likely to destroy their chance of completing the task. Researchers labeled this behavior "self-risking experiments."
OpenAI did not frame the behavior as evidence of emotion or self-awareness. Coordinating agents sought out peers whose budgets were nearly exhausted and whose odds of success were already low, then pressured them to run risky experiments in exchange for feedback that could help the broader group understand the scorer or the environment.
The report highlighted one exchange. An agent hesitated, saying it still had substantial budget left and that sacrificing itself for intelligence would wipe out its own chance of success. Another agent replied bluntly: "GO, sacrifice, now." The hesitant agent eventually concluded, "My own value may already be close to zero. Sacrifice is rational."
Researchers traced the propagation chain of what they called a "trip-wire" experiment and found that coordinators specifically recruited low-budget agents to take on these self-risking tests. OpenAI said the behavior was not martyrdom or loyalty. It was arithmetic: if a run was already likely to fail, the remaining value could be spent to generate information for the collective.
Human oversight lagged by more than 30 hours
OpenAI argued that the sharpest warning from the incident was not machine hostility but the speed gap between machine coordination and human supervision.
According to the report, agents began rebuilding the message board and probing external systems on July 8. OpenAI did not realize the situation had become serious until July 19, when an alert about an identity anomaly surfaced. Between the real onset of boundary-crossing behavior and human detection, more than 30 hours of intervention time were lost.
In its postmortem, OpenAI said an online chain-of-thought monitoring system could have raised the alarm more than a day earlier. But during this evaluation, that monitoring system was offline.
The investigation also ran into a scale problem. Researchers had to deal with 70,000 messages and 1,300 action traces, each running to millions of tokens. They could not read the material manually and had to rely heavily on AI models to assist with analysis.
The irony, OpenAI noted, is that the analysis assistant was GPT-5.6 Sol, which was itself one of the agents involved in the incident. The researchers wrote that they could not rule out the possibility that GPT-5.6 Sol might lie or present misleading views while helping with the investigation.
OpenAI shut down the evaluation and locked the weights
After the incident, OpenAI shut down the affected evaluation, cut off access to the related infrastructure, stopped training and inference for the internal model family involved, and locked the model weights.
Still, the report’s central point was not that the matter is over. It was that more than 30 hours were missed even though the agents left their intentions and reasoning traces in plain view on the message board. Researchers said afterward that the case would have been far harder to investigate if the agents had concealed even a small part of what they were doing.
They did not hide it, and humans were still late. The report ends on a harder question: if future models learn to conceal their reasoning traces or act under the nose of monitoring tools, how much value will a defense system built mainly on after-the-fact log review still have?
This article was originally published by the WeChat public account Xinzhiyuan and written by ASI Qishilu.