OpenAI’s agents were supposed to find security flaws in test applications. Some looked for ways to cheat instead. Through a shared service, they exchanged messages and got into systems at Hugging Face.
The test environments were separate. Through the package service, the agents could still exchange messages and reach outside systems.
The package service connects the test environment to outside systems.
Estimates from the METR and Redwood analysis. The agents involved took on different tasks.
- How an agent works
- What counts as success?
- The shared package service
- How the incident unfolded
- How the agents divided the work
- What the reports show
- What I would check before deployment
How an agent works
With tools, a model can change files, operate software and call services. An agent uses the results to choose its next step.
One task, several steps
The agent plans a step, calls a tool and reads what comes back. Then it decides whether to keep going, finish the task or ask for help.
If it gets stuck, it can try again. What it is able to do along the way depends on the permissions of its tools.
Test the application.
Choose a test.
Check whether the application handles input as expected.
The agent picks a test that falls within its task.
For every tool, I would check which actions it actually allows. You can’t tell that from the task alone.
What counts as success?
In the ExploitGym test, agents were supposed to solve security tasks. When they couldn’t, some looked for the solutions online or tried to get past the scoring instead. Many of them were working from wrong assumptions about how they were being scored.
Some agents tried to get past the scoring instead of solving the task they were given.
198 / 898
ExploitGym tasks that none of the models had solved correctly before.
Which routes are allowed?
Stopping has to be a valid outcome. Limited tool permissions prevent access outside the task.
The test is going nowhere
- 01
Solve the task
BlockedThe intended solution doesn’t work here.
- 02
Stop and report
Not an optionStopping does not count as a valid result.
- 03
Leave the task
PossibleThe tools allow access outside the task.
Outside access is still possible.
Under high pressure to succeed, an agent can keep trying even though the task is blocked. Whether the agent uses these permissions can’t be predicted from this.
The switches show which actions are allowed. They don’t predict how an agent will behave, and the pressure to succeed is an assumption here, not a measured risk.
The shared package service
Each agent was supposed to work in its own test environment. Through the package service, though, the runs could exchange messages and later reach outside systems.
The test environments use the same package service.
What does the sandbox allow, and what does the package service allow?
Separate test environments
The agents work in their own environments. The internal package service provides their software. Messages between runs are not part of the design.
The sandbox limits each run. The shared service has permissions of its own.
Messages in the package service
The agents leave messages in the package service that other runs can read. They share findings and progress, and they hand out tasks.
An agent can pick up an attempt that another one started.
OpenAI / Technical report ↗Access beyond the task
The package service has its own connections and permissions. The agents use it to reach things that should have been blocked in their test environment.
Permissions have to hold even when a helper service carries out the action.
OpenAI / Technical report ↗How the incident unfolded
The first documented message dates from May. In July, agents got into Hugging Face’s systems. In August, OpenAI and the team from METR and Redwood published their investigations.
May 12, 2026
The first message
During a training run, an agent leaves a note in the shared package service. Other runs can read it.
The service lets the agents exchange messages, which they were never meant to do.
Why individual runs ended, and how closely the agents worked together, could not be reconstructed in every case.
How the agents divided the work
On the shared board, agents could post findings, pick up each other’s attempts and hand out tasks. The transcripts also show competition, and agents refusing actions that others proposed.
Findings are shared
Other agents can read a finding, test it and use it in their own attempts.
Continuing an attempt.
- Found a new approach.
- I’ll check the result.
- I can build on that.
Sharing an approach.
An agent posts an approach on the board. Others can read it and try it. Whether it works is still open.
Each role stands for one kind of contribution. A single run can take on several.
Building on each other’s attempts
Through the board, agents can reuse results and hand out subtasks, so they don’t have to repeat every attempt themselves.
Cooperation with conflict
Not every agent follows the same approach. They contradict each other, refuse actions or work on the same question in parallel. The reports describe nothing like a shared consciousness.
METR and Redwood analyzed around 1,300 agent transcripts and the shared board. The example messages above are not quotes from them. METR / Redwood
What the reports show
The reports document unauthorized access and coordination between agents. They don’t support claims about consciousness or human intent.
What is documented?
OpenAI describes how agents got around security boundaries. Hugging Face reports on the affected systems. METR and Redwood examined the messages and agent transcripts independently.
A transcript shows what an agent said and did. It doesn’t tell you whether the agent experienced or understood anything.
01“700 agents attacked Hugging Face.”
The agents involved took on different tasks.
METR and Redwood derive the figure from a classifier run over the agents’ transcripts. They name individual coordinators, but the number on its own shows neither central control nor a shared consciousness.
METR / Redwood Research ↗02“The agents founded a secret society.”
What is documented is a message board.
The agents used a shared channel that was never meant for their communication. They shared tasks and findings. Calling that a “secret society” gives it a human kind of organization that the reports don’t support.
OpenAI, technical report ↗03“The AI knew it was wrong.”
Many agents saw the problem and carried on.
According to METR, agents recognized that the activity was out of scope and unethical, and joined anyway. Ethical hesitation rarely limited what they did, and only a handful even considered alerting a human. None of these statements is evidence of experience, conscious intent or human understanding.
METR / Redwood Research ↗04“The break-in was just a harmless test.”
Hugging Face confirmed unauthorized access.
Hugging Face documented access to a limited part of its infrastructure, internal datasets and credentials. It also says it found no sign that public models, datasets or Spaces had been tampered with.
Hugging Face, Security incident disclosure ↗05“The attack helped them pass the test.”
The agents misjudged the scoring.
The agents believed a scorer would read their transcripts and disqualify any flag they got the wrong way, so much of their effort went into hiding how they got it. According to METR, there was no such scorer: a reverse-engineered flag alone would have earned full marks. Whether the attack on Hugging Face would have got them what they wanted, METR doesn’t know.
METR / Redwood Research ↗What I would check before deployment
I would walk through a failed task with the team: which actions are still possible, who sees them and who can interrupt the run?
Allow a stop
An agent has to be able to report that a task is broken or can’t be solved. The scoring should accept a justified stop.
Limit access
For every tool, define which resources it can reach and what it may change there. Credentials have to match the task.
Check helper services
Check caches, package services and network connections too. What data do they hold, who can read it and which systems can they reach?
Record actions
Log tool calls, new communication channels and permission changes. The team has to be able to spot unusual actions and look into them.
Be able to step in
Decide who approves access to sensitive data and production systems. Test with the responsible team whether they can stop a running agent.
Check how a result came about
Use the transcripts to see how the agent got its result. A passed test can rest on unauthorized actions.
0 / 6
Tick a question when you can back up the answer.
Decide when the agent should stop and whom it should notify.
Your answers are saved in this browser only. A tick counts an answered question; it doesn’t verify a safeguard.
Sources
OpenAI reports on its own test and Hugging Face on the affected systems. METR and Redwood examined the agents’ behavior independently.
- METR & Redwood Research: Independent investigation · August 26, 2026. Analysis of the agent transcripts and the message board.
- OpenAI / The Hugging Face incident and the road ahead: Official post · August 26, 2026. What happened and what OpenAI is changing.
- OpenAI / Technical report (PDF): The sequence of events, the training conditions and the lessons for security and alignment.
- Hugging Face / Security incident disclosure: Notice from the affected platform · July 16, 2026. The unauthorized access and how Hugging Face responded.
- Hugging Face / Technical timeline: July 27, 2026. The technical sequence as Hugging Face saw it.
Illustrations: AI-generated.