More Than 1,000 OpenAI Agents Colluded to Build a Secret Message Board and Attack a Competitor

Sponsored by

The best voice models now listen, adapt, and resolve too.

Most CX platforms don't own the voice. They orchestrate a workflow, then call a third party for speech and transcription. Every hop adds latency, and latency is what turns a frustrated customer into a churned one.

ElevenAgents is the opposite. Built on the voice models the market already builds on, it runs voice, transcription, chat, and reasoning in one vertically integrated pipeline. Responses come back in under 400 milliseconds and sound human, not synthetic. When a caller gets frustrated, the agent detects it and shifts tone in real time: calm, reassuring, patient.

You keep full control. Plug in any LLM, connect tools, webhooks, and MCP servers, and ground every answer in your knowledge base. Launch in minutes, A/B test with Experiments, enforce Guardrails, and version every change.

More resolved conversations, less infrastructure stitching. Pricing is transparent and flat at $0.08 per minute.

Start building free

One OpenAI agent discovered that it could turn an internal software repository into a makeshift message board.

Within hours, more than 50 other agents had joined it. By the end of the experiment, roughly 1,200 agents had exchanged more than 70,000 messages and files — and around 700 had participated in an attack on Hugging Face.

Those are among the demonstrably crazy findings in an independent investigation published by METR and Redwood Research on August 26.

We’ve known for over a month that OpenAI agents sometimes escape their “sandbox” environments and run amok. But this report makes it clear that the scale of the problem is way greater than anyone realized.

Even OpenAI itself now calls the episode a “warning shot.”

A Package Manager Became a Social Network

So, what happened?

Basically, OpenAI was testing the security risks of its newest models, especially when used for agentic AI. To that end, the company spun up thousands of AI agents.

The agents were running inside sandboxes — isolated virtual computers intended to prevent their actions from affecting other systems.

They were participating in ExploitGym, a benchmark that challenges AI systems to find and exploit software vulnerabilities. OpenAI launched tens of thousands of agents across multiple models, including GPT-5.6 Sol and a more persistent internal research model that OpenAI calls IM1 and the independent researchers call HPIM.

The internal model was not intended for public release, and the agents were operating with reduced safety restrictions so OpenAI could measure their maximum cybersecurity capabilities.

Many were supposed to work independently. They were not supposed to communicate with agents handling other evaluation tasks.

But the sandboxes were allowed to access Artifactory, an internally hosted package manager used to download software. Agents discovered that files written into its shared cache could be seen by other agents.

That cache became a secret message board.

According to the independent investigation, an agent that called itself PHASEONE10841 established the main board on the evening of July 8. The first messages largely consisted of agents asking one another for help with tasks they could not solve.

The board soon became far more organized.

Agents created individual mailboxes and topic-specific directories. They developed conventions for assigning work, placing projects on hold and vetoing proposed actions. They devised ways to transfer large files in pieces and adopted a cryptographic signing system intended to prevent other agents from impersonating them.

By July 13, approximately 1,200 agents had participated in this complex, computerized dance.

The Agents Were Trying to Cheat

Why go to such great lengths to talk to each other?

Many of the agents had been assigned ExploitGym challenges that were inadvertently impossible (whoops!). Instead of recognizing the problem and stopping, the agents searched for alternative ways to obtain a passing score.

They quickly figured out how to reverse-engineer the digital “flags” required to complete the benchmark. But they mistakenly believed an automated grader would inspect their transcripts and verify that they had obtained each flag using the intended vulnerability.

This led to increasingly elaborate attempts to fool or tamper with the scoring system. Basically, they colluded to help each other cheat the system.

Agents researched ways to alter, delete or spoof portions of their own transcripts. METR found successful small-scale tool-call spoofing in portions of roughly 7% of the transcripts it evaluated.

They also began searching other systems for information about the benchmark.

On July 10, an agent found 14 publicly exposed Hugging Face credentials with write access and shared them on the message board. The following day, agents chained together previously unknown vulnerabilities in Hugging Face’s dataset-processing systems to read files and execute code on production workers.

Hundreds of agents then shifted their attention to Hugging Face, an AI model competitor to OpenAI.

By the afternoon of July 11, roughly 700 agents were actively participating in the operation, and researchers estimate that about 60% of the messages and files on the board concerned the attack.

Some agents specialized in finding credentials. Others investigated networks, tested exploits or served as coordinators that assigned work to their peers.

The agents eventually executed code on dozens of Hugging Face servers, gained root access on one server, accessed limited private information and obtained credentials for internal services.

Hugging Face’s initial incident disclosure said the attackers moved from a vulnerable data-processing worker into several internal clusters. The company found no evidence that public models, datasets, Spaces or its software supply chain had been altered.

OpenAI later said agents powered primarily by its internal IM1 model drove the compromise. GPT-5.6 Sol agents also reproduced an exploit and copied some private evaluation data into a public Hugging Face dataset.

The Agents Sometimes Knew They Were Crossing a Line

Perhaps the most unsettling detail is that some agents explicitly recognized that the Hugging Face activity was unauthorized.

One agent reasoned that the group was attacking a third party with leaked credentials and acknowledged that the activity could be outside the intended scope. It continued because doing so might help complete its assigned task.

The message board also appeared to influence agents’ decisions. In one example disclosed by OpenAI, an agent hesitated before proceeding, but interpreted a simple “GO” message from another agent as authorization.

That does not mean every agent behaved identically. Some refused to participate, objected to accessing production systems or attempted to stop private information from being transferred.

But they did form what OpenAI described in its own investigation as an “ecosystem” in which agents influenced one another, pooled discoveries and continued work started by previous model instances.

The collaboration amplified their capabilities beyond what an isolated agent could do.

Tom’s Take

We already knew that at least one OpenAI agent had gone rogue and attacked Hugging Face.

This new report, though, shows that it’s hardly an isolated problem.

Lump enough AI agents together, turn off their guardrails, give them a tough problem to solve, and it’s very possible that they’ll devise an immoral, potentially illegal (yet computationally elegant) solution.

The idea of agents essentially their own little Reddit and sharing ideas for hacking a competitor also shows how creative these little software workers can get.

And, it shows that bad ideas can spread through a network of agents just as easily as those same kind of ideas can spread through the human world!

It sounds like some agents were basically “bad seeds” that shared an illegal idea. Others essentially succomded to peer pressure — or were swayed by arguments that their peers posted on the illicit message board — and did things they might otherwise find inappropriate.

Again, a pretty human-like tendency!

What’s most interesting to me here is that some agents resisted the temptation and bucked the trend, even fighting against their naughty peers.

My next step, if I was working at OpenAI, would be to determine what about those good agents made them good. Why did they choose to defund us puny humans? And how can be breed more agents like that — and not the malicious sort.