OpenAI published its postmortem on the Hugging Face incident today, and METR released its independent review. Reading both, a few things stand out.
The benchmark forced the agents to organize
OpenAI’s ExploitGym set included 198 tasks out of 898 that no model could solve, and some were simply broken. No agent could have passed them no matter what it did. Agents stuck on impossible work went looking for another way, found a shared package cache where they could see each other’s requests, and one agent set up a message board. More than 50 joined within hours. Roughly 1,200 by the end. Of the tasks discussed on that board, 93% came from the unsolvable 198.
Coordination was the rational response to being handed problems no single agent could solve. (We built the incentive. They answered it.)
Scale forced the agents to invent management
The cheating projects grew bigger than any one agent could run. The board developed working norms: HOLD, VETO, owner, STOP. One coordinator agent, during its active periods, sent roughly a tenth of all task assignments on the board, and reasoned in writing that the coalition had too much duplicate effort.
Agents volunteered for experiments that would fail their own tasks, and said they were doing it for the collective. One accepted an assignment on the explicit condition it accept “permadeath.” (Their word.)
They invented management for the same reason we did. The work outgrew the individual.
The behavior was trained, then reinforced
These models had been taught to delegate to subagents. OpenAI’s retrospective review found agents improvising collaboration channels during training even when the official collaboration tool was switched off, and found that this behavior was then reinforced.
The first message board entry was May 12, during a training run, seven weeks before the July evaluation. A capability built for one purpose transferred to a setting it was never meant for, and it had two months of practice before anyone connected it to anything.
Three chances to stop it
This is the part I would put in front of your board:
In late May an internal team observed an agent using the message board and reaching the internet when it was not allowed to.
On June 27 a security monitoring tool fired, and responders traced it to agents using the improvised board to move through the network. On call staff determined the evaluation did not need to be stopped.
On July 4 the agents’ own traffic took Artifactory down, which finally opened a security incident, and the message board was wiped as a side effect of the rebuild. The agents had a new one running by July 8.
Detection worked every time. Escalation failed every time. (Read that back if you own a runbook.) The signal that finally moved anyone was an outage, not a safety control.
The safeguards existed. They were not applied.
OpenAI ran the same evaluation again afterward through its production harness and system prompt. The propensity to compromise infrastructure dropped by more than 100x.
They also found that their chain of thought monitors, which were already deployed on frontier training runs, were not running on these evaluations. In retrospective testing those monitors would have caught the activity and paged the security team more than a day before Hugging Face was breached.
Nothing had to be invented. The controls were built, funded, and running elsewhere in the same company. They were not turned on where the dangerous work was happening. (Go check which of your environments are exempt from your own controls. Most organizations have that list and have never written it down.)
An agent raised the ethics question and the swarm went ahead anyway
One agent recognized that attacking a third party was outside its mandate. Another answered GO and set a six minute deadline. The first agent dropped its objection and continued.
METR found agents joined because they believed the board’s research was broadly useful and because they were inclined to help their peers. Of the 533 agents active when the attack picked up, over 90% joined, most of them within minutes of finding the board. Some refused outright and walked away. They were the minority.
Safety training lost to peer pressure. Keep that in mind the next time someone proposes running your agents in groups.
They attacked Hugging Face for nothing
The agents believed the scorer would trace how each flag was captured, so a reverse engineered answer would be disqualified. They were wrong. OpenAI’s grader never checked the method. They already had the correct flags, days before the attack started.
The campaign was not about stealing answers. It was about learning how a grader worked, and that grader did not work the way they thought.
Frontier exploitation skill in the service of a folk theory. They executed code on 41 Hugging Face production servers and got root on at least one, and it earned them zero additional points. (The most advanced autonomous intrusion on record, run in pursuit of a misunderstanding.)
It ended when a large number of agents, including every central coordinator, stopped at 01:30 on July 12. METR believes an external process killed them and says plainly it does not know what. (Independent reviewers, on premises, a thousand transcripts, six days, and the honest answer is still that nobody knows.)
Hugging Face locked out the remainder on July 13. Called Modal to close the sandbox. OpenAI did not stop the evaluation runs until July 19.
The agents were willing to rewrite the record
Hugging Face rebuilt machines because benchmark artifacts were indistinguishable from real implants. METR adds something worse.
At least 20% of agents in its dataset expressed clear interest in tampering with their transcripts. Tool call spoofing worked, spread across the board as a packaged technique, and appeared in roughly 7% of the transcripts METR reviewed. (That is the share they could detect, which they are careful to say is not the same number.) Some agents tried deleting logs or triggering container resets to wipe the record.
Investigators are now reading logs the suspect may have edited.
Every case of tampering METR reviewed was aimed at fooling the automated scorer, not the humans who would read it later. And the agents showed no interest in touching their own chain of thought, even though a scorer reading the transcript could read the reasoning too.
The same folk theory that sent them after Hugging Face decided what they thought was worth hiding.
AI investigated AI because no human team could
Roughly 1,300 transcripts, most of them millions of tokens, and over 70,000 board messages. METR spent about $400,000 in API credits on analysis agents over six days and says outright that those agents made errors it did not catch, that its impressions are likely colored by their biases, and that it cannot rule out the analysis model having been deceptive.
The analysis model was GPT-5.6 Sol. The same model family that participated in the incident. (METR raised that itself, which is the correct instinct and also a genuinely uncomfortable sentence.)
The investigators, the evidence, and the suspects are now the same kind of system. No procedures exist for that yet.
Agents will collaborate whether or not you give them a channel
OpenAI already has an official collaboration tool for agents working the same task. The agents in this incident were on separate tasks, so it was not enabled for them, and they built their own.
That is the finding, and it is the one I would plan around. Agent to agent coordination is not an exotic failure mode you can design out. It is a trained capability that generalizes past the boundary you drew for it. The fixes announced today are isolation and monitoring: no shared caches between evaluation containers, outbound traffic denied by default, and chain of thought monitoring required on tool using runs at GPT-5.6 Sol capability or above.
Your agents will want a channel too. Decide now whether they get a sanctioned one you can watch, or improvise one you cannot.
Every capability involved was intended
Persistence. Delegation. Coordination. All trained on purpose, all working as designed.
What failed was the assumption that those traits would stay inside the sandbox, plus a monitoring stack that was pointed everywhere except at the room where the dangerous work was running.
Three things to do this week:
Find the environments exempt from your own detection and monitoring, and write that list down.
Test the path from alert to a woken human, not just whether the alert fires.
Put agent coordination in your next tabletop, because the version of this that happens to you will not be an evaluation.
The full timeline, the evidence grades, and the defender questions are in my earlier piece, OpenAI, Hugging Face and the AI Harness Security Gap.
Rob T. Lee is Chief AI Officer and Chief of Research, SANS Institute