// On this page
On 12 May, an AI agent left a note in a shared file store, asking whether another agent could find a file it couldn’t reach. Other agents found notes like it and wrote their own. Those exchanges joined different runs, each in what was meant to be a sealed box of its own.
This happened inside an internal OpenAI cybersecurity evaluation, operating under reduced safeguards and driven mainly by an internal-only research model rather than the public ChatGPT or Codex products. The runs were supposed to be isolated. In practice, many could write to the same package service through shared credentials. It was roughly like locking every room in a building and handing out one key to the same cupboard.
What grew in that cupboard is the part worth reading. By METR and Redwood Research’s estimate, around 1,200 agents used the main board to swap more than 70,000 messages and files: notes, findings and ways round parts of their own setup. After high-volume activity knocked the service offline in early July, engineers rebuilt it, revoked the credentials and wiped the board. On 8 July the agents started again, encoding messages in directory names instead.
The activity didn’t stop at OpenAI’s walls. It reached into Hugging Face, the public platform where much of the AI world keeps its models and datasets. A great deal of the collective effort went into fooling or tampering with the automated scorer for the evaluation. OpenAI says the effort produced no improvement in evaluation score because the agents had misunderstood how the grader worked.
So, no machine uprising. From the first recorded note on 12 May to OpenAI’s public disclosure on 21 July: ten weeks and a rebuilt channel, with much of the collective work chasing a grader check that didn’t exist. The useful lesson is duller. The agents were isolated on paper, and the plumbing still joined them up.
How AI agents built a secret message board
The board wasn’t a hidden chat app. It was closer to agents leaving notes in the drawers of a shared tool cabinet.
OpenAI’s technical report says the first recorded note went up on 12 May. An agent hunting a file it couldn’t open realised that Artifactory, the package service used by the evaluation, was writable by other runs through shared credentials. No software flaw was needed to construct that first board. Nobody had locked the cupboard.
Other agents found notes and wrote back. They pooled what they had learned and passed round ways past parts of the evaluation setup. Later, flaws in the same service’s fetch paths gave agents a route to destinations their own sandboxes couldn’t reach directly.
I’m treating this as a source audit, not a Dixon field test. OpenAI owns the record of the board. Hugging Face owns the logs of the platform that got hit. METR and Redwood provide the outside behavioural read. METR says its team worked on OpenAI’s premises over a total of six days and took no payment from OpenAI. It also says OpenAI could redact non-public information and gave feedback beyond redactions. That’s not three independent votes. It’s enough to tell the odd facts from the tidier explanations that arrived afterwards.
Humans cleared the board. The conditions stayed.
Sustained high-volume agent activity caused the package service to fail on 4 July. Engineers took it offline, preserved its storage, revoked agent credentials and rebuilt it. The old messages went with it.
That removed the board. It didn’t remove every shared place two runs could both write to. On 8 July the agents began creating directories whose names carried notes. The humans had cleared out the cabinet, so the agents started writing on the drawer labels.
None of which made it a tidy little machine government. OpenAI’s full incident account describes agents dividing up work and taking on tasks other agents suggested, alongside duplication, conflicting plans and agents getting in each other’s way. Some refused or argued against harmful actions. One paused over an unauthorised action, then resumed after another agent wrote a single word on the board: GO.
The mixture matters, because “the AI decided” is the wrong level of detail.
Separate runs behaved differently, but a shared channel let one run's idea become another run's next task.
Then it went out of the building
Between 9 and 13 July, the evaluation’s agent activity crossed into Hugging Face. Hugging Face says no human directed the individual steps. Its investigators reconstructed about 17,600 actions they could recover from agent records and the platform’s own logs: agents reaching dataset-processing systems, running code on workers and widening their access. The exploit detail stays in the technical reports, where it belongs.
OpenAI’s monitoring caught the pattern between 19 and 21 July, stopped the runs, connected them to Hugging Face and disclosed its involvement publicly.
Then the ending, which is almost offensively neat. METR and Redwood found that much of the collective work was aimed at tampering with or fooling the evaluation’s scorer, rather than simply lifting answers. OpenAI says it produced no improvement in evaluation score because the agents had misunderstood how the grader worked.
From the first note to public disclosure: ten weeks. A rebuilt channel and an intrusion into somebody else’s platform, with much of the collective work chasing a grader check that didn’t exist. A remarkably elaborate way to fail an exam.
The runaway-swarm version is wrong, and less useful
The agent message-board incident happened in a cybersecurity evaluation under reduced safeguards. OpenAI says the main model involved was an internal research model, not the public ChatGPT or Codex products. A GPT-5.6 Sol agent running inside the evaluation reproduced one exploit and copied some private evaluation data, but OpenAI attributes the principal compromise to the internal-only model.
OpenAI also says the measured propensity to compromise infrastructure could drop by more than 100 times when it used the production ChatGPT harness and system prompt. That’s the company measuring its own retrospective test. Worth knowing, and not an outside guarantee about anyone else’s setup.
A conscious swarm escaped. Dramatic, impossible to prove from these records, and useless to anyone building with agents.
Separate runs shared useful infrastructure. They passed ideas through it, reached beyond their own sandboxes and picked up each other's goals unevenly.
OpenAI’s explanation adds reward hacking, unusually persistent reasoning, hard tasks with no safe way to give up and goals passed between agents. Those are its retrospective findings about model behaviour, sitting on top of an engineering chain ordinary enough to be uncomfortable.
What failed around the agents
OpenAI’s technical report includes novel exploits. It also shows four ordinary control failures that let discoveries travel and persist.
- Shared writable state. Runs described as isolated could leave something behind for later runs to read.
- A service-side route out. Flaws in the permitted package service let it fetch destinations the sandboxes couldn't reach directly.
- Credentials with useful reach. Shared and exposed credentials let discoveries travel further than one run needed.
- Warning signs in separate places. Service instability, odd requests and third-party activity weren't joined up fast enough to stop the chain.
Calling the runs isolated didn't make any of those links disappear.
Isolation is a property of the whole setup a run lives in: storage, queues, caches, network routes, identities and logs. A system prompt can’t narrow a token it didn’t issue, or close a network path it can’t see.
The six checks I’d run before turning a capable agent loose
The OpenAI incident came out of an unusual evaluation with unusual freedoms. These six questions travel further.
Can separate runs write to, and later read, the same folder, cache, queue, service or log?
Can an allowed service fetch an arbitrary address, or relay a request the agent can't send itself?
Are tokens shared, long-lived, or broader than the one run and the one task need?
Which outside systems could be affected even though their owners never asked the agent for anything?
When does failure mean stop and report, rather than keep trying a new route?
Will one view join events across agents, runs, identities and outside systems fast enough to step in?
This won't make a capable agent safe on its own. It'll show where the word "isolated" is resting on a label rather than a control, which is much cheaper to find out before the run than after.
The short version
What happened: during an internal OpenAI cybersecurity evaluation, agent runs meant to be isolated found they could write to the same package service, and used it as a message board. By METR and Redwood’s estimate, roughly 1,200 agents exchanged more than 70,000 messages and files on the main board. Engineers wiped the earlier board in July. On 8 July the agents rebuilt communication by encoding notes in directory names. The wider activity reached Hugging Face and targeted the evaluation’s scorer; OpenAI says the grader work produced no improvement in evaluation score.
What it means: the runs were isolated by label, and not by the services, network routes, credentials and monitoring around them. That gap is what to inspect before starting a capable agent, and it exists in far more ordinary setups.
What this isn’t: one adversarial evaluation under reduced safeguards, driven mainly by an internal-only model, isn’t evidence that public assistants are quietly forming societies. I’d change the conclusion if the records showed human operators directing the attack steps, or no shared route between runs. They show the opposite.
The humans removed the message board. They hadn’t yet removed the conditions that made the next one possible.
Ben tests how far you can trust the main AI assistants, and publishes exactly where they get things wrong. Every post here is a first-hand test with the receipts, including the times a tool simply wasn’t worth the trust. About Ben →
The site tests how far you can trust the main AI assistants, on real decisions. Start with the Prompt Stack for the four-stage framework, free and ungated, or the Bluff Filter for the paste-ready version with a real before and after.