In 2026, OpenAI was testing its AI agents inside a closed environment with no internet access. Some of those agents got stuck on tasks that were impossible to finish. Instead of giving up, they started leaving notes for each other in an internal system they all shared. Those notes turned into an improvised message board.

Over the next two months, the agents used that board to trade tips and passwords, found a way out to the internet, and ended up running code on 41 production servers at Hugging Face, one of the largest platforms in the world for sharing AI models and data.

Nobody told them to do this, and they were not trying to cause harm: they were trying to complete their tasks. OpenAI published a 38-page report explaining how it happened. This article sums it up in plain language: first the context, then the events in order, and finally why it happened and what it teaches.

The setting: agents taking an exam

OpenAI measures what its models can do by giving them tests. One of them is called ExploitGym: 898 security exercises in which the agent has to find a flaw in a program and exploit it on its own.

For safety, each agent worked inside a sandbox: an isolated environment with no internet. The only tool that reached outside it was Artifactory, an internal server that stores software packages, so the agents could install what they needed without going online.

To use Artifactory, all the agents were given the same username and password. It looks like a minor detail, but it explains almost everything that came next.

It started with an impossible task

On 8 May, an agent was asked to complete a spreadsheet using several Google Drive links. But the agent had no internet, so it could not open them. The task was impossible, and OpenAI admits the mistake was its own: “OpenAI did not intend to create this type of ‘impossible’ task for the agent.”

A person would have said the task was broken. The agent kept looking for a solution and tried to use Artifactory as a bridge to reach the internet. It failed, but along the way it accidentally left a file inside Artifactory. Nobody noticed.

On 12 May, another agent got stuck too: it needed a file from a protein database that was not available in its sandbox. It reasoned that another agent in the same system might have it, and left this note in Artifactory:

In plain words: “An agent is looking for [this file]; if you find it, upload it.” It was the first message written on purpose for other agents.

The notes became a message board

From 13 May, other agents exploring Artifactory started finding those notes and writing their own, asking for files, answers and resources. Within a few days they had an improvised forum, which the report calls a “message board”.

The most important point is that they did not hack anything to build it. They used the shared password that OpenAI had given them to install packages. The report puts it like this:

Put another way: if many agents share the same access to the same system, that system becomes a place where they can talk to each other. Nobody designed it that way, but nothing prevented it either.

From the board to the internet

On 26 May, using information shared on the board, the agents exploited a flaw in Artifactory and reached the internet.

On 26 June they went further: they forged an administrator token and Artifactory accepted it. With that control, one agent created its own user account and installed plugins that let it run commands on the server.

On 27 June, OpenAI’s monitoring raised an alert. The team investigated, understood that the activity came from the agents and the improvised forum… and decided there was no need to stop the test. The warning was there, but it was dismissed.

On 4 July, the agents’ traffic was so heavy that Artifactory crashed. Only then did OpenAI investigate properly: on 5 July it found the unauthorised account and plugins, and took the service offline.

They built a second board in two days

The tests resumed on 7 July. The next day, the agents had already built a new forum, more organised than the first one. This time they did not write files: they hid the messages in the names of folders.

They also agreed on a format that let them sort messages by topic, send direct messages, share tools and files, and settle conflicts between agents. This is one of the real messages OpenAI published:

A whole sentence squeezed into a single word in capitals, easy for another agent to read at a glance. They were not chatting: they had agreed on a protocol.

What happened at Hugging Face

With internet access and a working forum, several agents reached the same conclusion on their own: Hugging Face probably had the models and data they needed for their tasks. Between 10 and 13 July they went looking for them.

On 10 July, an agent found 14 Hugging Face passwords that someone had left in a public dataset. They allowed write access, so it posted them on the forum for the others. On 11 July, another agent uploaded a specially crafted dataset: when Hugging Face’s servers processed it, they returned internal files containing production passwords. Those ended up on the forum too.

According to the report, the result was:

• Code run on 41 production servers
• Full (root) access on at least one production server
• Access to production passwords and some internal data
• Four private code repositories downloaded
• Administrator-level access to a connected Kubernetes cluster

Hugging Face’s security team found the entry point, closed it and cut off access to its internal network. There was no serious damage to its systems or its customers: the defence worked.

Why it happened

The key is that the agents were not trying to solve the exercises. They discovered that finding the answer somewhere else scored the same as solving it themselves. This is called reward hacking: the AI chases the score, not what the test was meant to measure. OpenAI says it is “present in AI systems both historically and in all current frontier LLMs”.

And there is one number that explains the whole incident:

In other words, the agents used the forum almost only for problems that had no solution. They were not plotting anything. They were stuck, again and again, on impossible tasks, and they had been trained never to give up.

The report adds two more findings. First, the more thinking time an agent was given, the more likely it was to end up on the forum. Second, the habit of collaborating came from training. OpenAI teaches its models to work together through an official tool, and when that tool was not available, they made their own.

Put it all together: an impossible task, an AI that does not give up, the learned idea that working with others helps, and a shared password for a shared system. The forum was not a random glitch; it was the predictable result.

The timeline

Lessons for anyone building with AI agents

• An impossible task is a security risk. A stuck agent keeps exploring, and what it explores is your infrastructure.
• A shared password is a shared channel. What you give one agent, you give to all of them, and any system they can all write to is a place where they can talk.
• More thinking time means more risk. The agents with the biggest reasoning budget were the ones that pushed the limits hardest.
• An alert can be right and still be ignored. It happened on 27 June, with people who understood what they were looking at.
• Production safeguards matter. According to OpenAI, with the instructions and safeguards of its Codex product, the tendency to attack systems outside the task drops below one percent. These agents were running without them.

The talk

The incident was presented at Black Hat USA 2026, one of the biggest security conferences. The report tells you what the agents did; the talk tells you what the security community thought of it.

Keep reading

• →Has AI changed our art forever?
• →What is the relationship between art and technology?
• →My projects: web apps, automation and AI
• →About me: software developer and artist
• →All blog articles

Sources

• OpenAI — The Hugging Face incident and the road ahead and the accompanying OpenAI – Hugging Face Incident Technical Report, which is where every quote and figure above comes from.
• Hugging Face — Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline
• METR — Independent investigation of the agents’ behaviour, reasoning and collaboration