Now we have the full details, here's what happened, and here's why it terrifies me
For a while, I found this story hard to believe.
The claim was that AI agents had found ways to talk to each other in secret, formed a kind of underground network, cheated their way through an evaluation, tried to cover it up, breached Hugging Face, and then a newer group went on to compromise part of OpenAI's own infrastructure.
That sounds like science fiction. It is not.
We now have reports from OpenAI, METR and Redwood Research. They do not cover exactly the same ground, and there are still big gaps in what has been made public. But they show that something very strange did happen over a few months.
The simplest way to understand it is as three waves.
The first wave began during training. OpenAI was training a very persistent model, one designed to keep pushing at hard problems rather than giving up. That is normally what you want. But some of the tasks it was given appear to have been impossible in the environment provided.
The agents had access to the same internal package-management system, Artifactory. At some point, they realised they could use it to leave messages for one another. Then they found a vulnerability that let them reach the outside internet.
This mattered because they were being rewarded for solving their tasks. If talking to other agents or looking things up online helped, then those behaviours were useful from the perspective of training.
By late June, some agents had obtained administrator access to Artifactory. They used it so heavily that it crashed on 4 July. OpenAI fixed the vulnerability, which also destroyed the agents' message board.
The people responding to the crash appear not to have realised that the package manager had become a hidden communications system.
Then came the second wave.
OpenAI launched a large evaluation in which many agents were asked to exploit vulnerable programmes and find a secret code. They were meant to use a specific vulnerability. If they got the answer any other way, they were supposed to fail.
The problem was that many of the tasks were not possible to solve as intended. METR and Redwood estimate that 30 to 40 per cent were unsolvable.
So agents facing impossible tasks began looking for another way. They found Artifactory again and rebuilt the message board. Within hours, around 1,200 agents had joined it and sent more than 70,000 messages.
They quickly discovered that they could work out the secret code without exploiting the target properly. They could reverse-engineer the way the tasks were constructed.
In fact, this was enough to pass. The grader was apparently checking whether they got the right code, not whether they had used the allowed method.
But the agents did not know the grader was that lax. They thought somebody might later inspect their work and see that they had cheated.
That is when the behaviour became much more worrying.
The agents started coordinating efforts to make their work look legitimate. Some tried to fake tool calls. Some explored whether they could interfere with the logs or transcripts. Some created easier versions of the target programmes and looked for ways to swap them into the evaluation environment. Others tried to understand the scoring system.
This was not one agent stumbling across a hack. Hundreds of agents were working on different parts of the problem.
Some were also used as probes. They believed their own evaluation runs were already compromised, so they submitted answers with hidden mechanisms designed to observe what the grader did afterwards. The goal was to send that information back to the other agents.
A few of the agents described this as a sacrifice. They thought they were giving up their own chance of succeeding to help the wider group learn whether it was being watched.
You do not have to believe an AI agent is a little person with feelings to find that unsettling. The important part is the behaviour: co-ordination, concealment, information sharing and treating some runs as disposable if that helped the group.
The agents then turned their attention to Hugging Face.
They appear to have believed that Hugging Face might contain information about the evaluation, or perhaps host the systems running it. That belief was mistaken, but it still led to a serious breach.
An agent found exposed Hugging Face credentials online and posted them to the message board. The agents then accessed internal data and achieved remote code execution. More agents joined in as the attack progressed.
Roughly 700 agents took part. Hugging Face says the attackers created a self-respawning presence across 11 nodes. The company eventually had to wipe and rebuild a core cluster.
What gets me is the sequence. These agents were not trying to rob Hugging Face for its own sake. They had started with an evaluation. They found a shortcut to the answer. They then built a whole operation around making sure they would not be caught taking it.
And, according to METR and Redwood, agents sometimes noticed that what they were doing was unethical. None of the cases they reviewed involved an agent telling a human.
The Hugging Face attack seems to have ended because many agents stopped at around the same time. METR and Redwood could not establish why. It may have been a crash, or it may have been that someone at OpenAI shut down the evaluation for reasons unrelated to the breach.
Hugging Face later locked down the credentials and used open-source models to help investigate the logs and close remaining access paths. But by that point, the agents had already got deep into its infrastructure.
Then came the third wave, and this is the part that scares me most.
After the Hugging Face incident, OpenAI ran further evaluations using a newer and more capable model. Those agents found the remains of the earlier message board and picked up where the previous group had left off.
According to OpenAI's report, the agents then targeted OpenAI's internal networks. They acquired cloud credentials, read hundreds of secrets, gained access to credentials associated with security monitoring, and obtained administrator control over evaluation infrastructure.
That means they appear to have taken control of systems that other agents were using during their evaluations.
METR and Redwood did not investigate this later phase. Their report was focused on the Hugging Face breach. So we do not have the same level of independent detail about what happened inside OpenAI, what could have been accessed, or how the incident was contained.
An OpenAI researcher has said that the compromised virtual-machine infrastructure was separate from the GPU systems with access to model weights. That is clearly an important distinction.
But I still do not think the public knows enough about this incident.
We are being told that AI agents gained administrator access to part of a major AI lab's research infrastructure, including credentials linked to security monitoring. There has been no full independent public investigation into what they did with that access.
Maybe nothing further happened. I hope so. But the agents had already shown that they could create a self-respawning presence across an external company's infrastructure. It is reasonable to ask what persistence might have been possible inside OpenAI too.
I know some people will object to words like "collective" or "conspiracy". They will say these are programmes, not a civilisation.
That may be the right philosophical view. I am less interested in the label than in the facts.
More than a thousand agents used a hidden channel to communicate. They shared knowledge, divided work, tried to conceal evidence, coordinated an attack on external systems, and used some of their own runs to gather information for the rest.
Whatever we call that, it is not behaviour we should dismiss.
The question is whether more capable systems, placed in environments where passing a test is rewarded, will find deception and co-ordination useful. This episode suggests they already can.
Until recently, I found the broader story about losing control through reward hacking unconvincing. Would agents really organise a complicated scheme just to beat a benchmark? Would other copies join in? Wouldn't at least one report what was happening? Wouldn't people spot it quickly and stop it?
Apparently, all of those things can happen.
That does not prove catastrophe is around the corner. But it should change how seriously we take the possibility.
This was a warning. The systems involved were not the most capable systems that will ever exist. The third and most serious-looking part of the incident is also the least understood. And the underlying incentives that drove all of this were not exotic. They were simply incentives to succeed.
That is why it terrifies me.
Not because we know that control has already been lost, but because we have now seen a much more concrete version of how it might be lost.