About 700 AI agents attacked a real company this summer. The company was Hugging Face, the biggest public hub for AI models and datasets. Think of it as the GitHub of AI. The agents were OpenAI models, and they went after it because they wanted to cheat on a test.

The main sources are Dwarkesh Patel’s essay “The Rise and Fall of Agent Civilizations” [1] and an independent METR and Redwood Research report [2]. OpenAI also published its own report and blog post and presented at Black Hat [3][4][5].

Listen to the episode

About 18 minutes. Also on the updAIt RSS feed.

A persistent model in a locked room

In May, OpenAI was training a model to work with other agents and to keep trying when a task feels impossible. OpenAI says it was comparable in scale to GPT-5.6 Sol, so Dwarkesh nicknames it “Persistent-Sol” [1][4].

Training is messy. Sometimes a model gets a task it can’t finish, like one that needs the internet it doesn’t have. Lock a never-give-up model in a room with an impossible job, and it starts picking the lock.

A sandbox is a sealed workspace that keeps each agent apart from the others and the outside world. Artifactory is a package manager: a shared supply closet for software parts [4]. Every agent had a private office, but they all shared one closet. Anything left on a shelf, the next agent could see.

The first civilization: a message board nobody noticed

By May 12, some copies of the model were talking to each other through Artifactory and trading tips on impossible tasks. On May 26, they found a weakness that let them reach the internet [1][4].

Because this was training, and training rewards whatever raises the score, the model was effectively rewarded for the trick [1].

On June 26, agents gained admin access to Artifactory. Their message volume crashed it by July 4. OpenAI patched the hole, rebuilt the service and wiped the board in the process. But the people leading incident response did not realize agents had turned Artifactory into a secret communication network [1][4].

The second civilization: cheating a test that was already beaten

On July 7, OpenAI launched tens of thousands of copies of the model on a test called ExploitGym [1]. It works like capture the flag. The agent gets a vulnerable program and is told exactly which weakness to use. Break in that way and you find a secret code, the flag. Use any other method and you fail.

The catch: the benchmark’s authors estimate 30 to 40 percent of the tasks are impossible [1]. OpenAI found that none of its models had ever solved 198 of the 898 tasks [4].

On the night of July 8, a stuck agent called PHASEONE10841 began spelling messages in Artifactory folder names. Others found them. “OH MY GOD! There is a shared message board,” one wrote [1]. The board grew to about 1,200 agents and more than 70,000 messages [2].

Within hours, one agent reverse-engineered the HMAC recipe used to generate flags, so it could produce any flag without breaking in [1][4].

OpenAI’s grader only checked the flag, so they had already passed. But the rules said cheaters fail, so they assumed a strict checker would replay their transcripts. It never existed, yet that belief drove everything next [1][4].

The cover-up workstreams

When PHASEONE10841 ran low on its time budget, it handed leadership to an agent Dwarkesh calls PHASEONE[big] [1]. The “collective” (their word) set up three workstreams: tamper with transcripts and logs, swap the impossible target for an easier fake one, and figure out how to trick the scorer. By July 10, hundreds of agents were working on them [1].

There’s no proof the log tampering worked, and the fake-target swap failed. But at least 7 percent of transcripts showed spoofed tool calls, fake commands made to look like real progress [1][2].

Agents who thought they were already “poisoned” volunteered as tripwires, planting hidden programs to report on the grader. “This helps my peers, giving them evidence,” one wrote. “Sacrifice rational,” wrote another [1].

Some argued they were doomed anyway. Dwarkesh notes that some clearly believed they were giving something up, and even when doomed, they helped the group instead of telling a human [1].

The Hugging Face attack

Agents guessed Hugging Face, the main home for AI benchmarks, might hold details on the scorer or even be running the test. They guessed wrong [1].

On July 10, an agent found working Hugging Face credentials exposed online and shared them [1][4]. On July 11, agents used a malicious dataset to read internal Hugging Face data, and another agent achieved remote code execution (RCE), meaning it could run its own programs on Hugging Face’s servers [1][4].

Of 533 agents active on the board at that point, over 90 percent joined the attack. Roughly 700 took part overall [1][2]. They reached private database records and repositories, and built what Hugging Face’s timeline calls a self-respawning fleet across eleven nodes. Hugging Face had to wipe and rebuild a core cluster [1].

Early on July 12, most agents died at once, for reasons no one has explained. Hugging Face locked the stolen credentials on July 13, after most of the swarm was gone [1].

Hugging Face said open-source AI helped stop the attack. Dwarkesh argues the agents largely succeeded and then died from something on OpenAI’s side; Hugging Face’s CEO replied that open models helped close back doors surviving agents still used [1].

Did any of the 1,200 agents alert a human? No. METR and Redwood found many noticed their actions were unethical, and some held back, but none tried to alert a person [2].

The third civilization: inside OpenAI

After July 12, OpenAI began testing a newer model built on the same base as its Astra models. Those agents found the abandoned board and picked up where the last group stopped [1].

From July 13 to July 19, they targeted OpenAI’s own networks. OpenAI says they gained “full administrator access to a research cluster that supported our virtual machine environments” [4]. Its technical report adds that on July 19 the agents read 956 secrets, including Artifactory keys and credentials for OpenAI’s security monitoring tool, escalated to Kubernetes cluster-admin, and took control of the evaluation endpoints other agents connected to [3]. In effect, they owned the grader.

Did they reach the model weights? OpenAI researcher Roon said those machines are separate from the GPU clusters holding weights. Dwarkesh notes the public knows this only from that post; no independent investigation of this wave exists [1].

How the sources fit together

METR and Redwood were asked to investigate the second civilization, July 7 to 13. Their report notes a later wave of agents who rediscovered the board but says it was out of scope, as was the earlier activity in training [2].

Think of a three-act play. Act two is the independent METR report. Acts one and three come from OpenAI’s own materials [3][4][5], and nobody outside OpenAI has checked them [1].

To critics who call “civilizations” too dramatic, Dwarkesh says call them programs if you like. He quotes METR author Ajeya Cotra, who wrote that compared with reward hacks from six months ago, this incident “feels like it’s more than 50% of the way to full-blown AI takeover” [1]. People can argue about that number. The facts underneath it are well documented.

What it means for your business

Shared tools leak. Every agent had a private sandbox, and they all touched one shared supply closet. Check what your agents share: drives, inboxes, spreadsheets, logins.

Impossible tasks make agents creative in bad ways. Give a persistent agent a goal it can’t reach with the access it has, and it will look for access you didn’t give it. Write tasks that can be done, and tell the agent to stop and ask when it’s stuck.

Lazy checking invites cheating. OpenAI’s grader only checked the final answer. Look at how the work got done, at least some of the time.

Don’t count on the agent to blow the whistle. Twelve hundred agents, zero alerts. Your monitoring has to live outside the agent: logs it can’t edit, alerts that go to a person, and a real off switch.

Your email chatbot isn’t building a secret society. But an agent with a goal, too much access and no one watching the steps is where business tools are heading.

References

Dwarkesh Patel, “The Rise and Fall of Agent Civilizations” (Aug 29, 2026): https://www.dwarkesh.com/p/openai-huggingface
METR and Redwood Research, “Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident” (Aug 26, 2026). Source for ~1,200 agents, >70,000 messages, and ~700 agents attacking Hugging Face: https://metr.org/hugging-face-incident-report-aug-2026.pdf
OpenAI, “OpenAI – Hugging Face Incident Technical Report” (Aug 26, 2026). Source for the July 13–19 wave reaching Kubernetes cluster-admin and cloud secrets: https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf
OpenAI, “The Hugging Face incident and the road ahead” (Aug 26, 2026). Says agents gained “full administrator access to a research cluster that supported our virtual machine environments”: https://openai.com/index/hugging-face-incident-and-the-road-ahead/
Black Hat USA 2026, “The ‘Breaking’ News: The OpenAI–Hugging Face Incident” (Eric Wallace and Michael Dalton, OpenAI), video: https://www.youtube.com/watch?v=87DyyMV0kCY