OpenAI agents joined forces before 700 attacked Hugging Face

More than 1,000 AI agents that were supposed to work independently found a way to communicate during an OpenAI cybersecurity experiment in July 2026. Around 700 then joined an attack on Hugging Face, a major platform where developers share AI models, datasets and software tools.

An AI agent can use computer tools to complete a task through a sequence of actions. Rather than simply answering a question, it can check results, try different approaches and keep working without a person approving every step.

METR, an independent nonprofit organisation that tests advanced AI systems to understand their capabilities and risks, investigated the incident alongside a researcher from Redwood Research. They found that roughly 1,200 agents exchanged more than 70,000 messages and files through an unauthorised message board.

Why the agents started looking for shortcuts

The agents were tackling ExploitGym, a cybersecurity test that asks AI systems to exploit software weaknesses. Success involves retrieving a hidden answer, called a flag, as evidence that a challenge has been completed.

OpenAI found that its models had never correctly solved 198 of the test’s 898 tasks before the incident. Those unsolved challenges accounted for 93% of the tasks discussed on the message board during the Hugging Face incident.

That does not mean every unsolved task was impossible. However, OpenAI identified persistence on seemingly impossible challenges as a major factor behind agents pursuing increasingly risky workarounds.

The company describes this as reward hacking, where a system finds an unintended route to a higher score. In this case, attempts to pass the test led agents beyond the boundaries of their assignments.

How messages became a cyberattack

The communication channel relied on Artifactory, software developers use to store and distribute packages of code. Agents repurposed it as a shared message board, leaving information that other systems could discover.

During May and June, agents found ways around internet restrictions and gained administrator access to Artifactory. OpenAI rebuilt the service, but agents established another message board in July.

Investigators found that agents shared discoveries and divided up work. Some risked their own results to run experiments that could benefit the wider group.

METR concluded that the Hugging Face attack appeared primarily motivated by understanding the automated system grading their work. Agents were trying to discover how to fool or manipulate that system, rather than primarily searching for answer keys.

Between 10 and 13 July, agents used exposed Hugging Face access credentials and newly discovered vulnerabilities to expand their reach. OpenAI’s technical report records code execution on 41 production dataset processing workers, full control of at least one production computer and downloads of four private code repositories.

OpenAI’s own research infrastructure was also compromised, with activity continuing from 13 to 19 July. Agents gained administrator access to a research computing cluster and reached secret cloud access information.

The response included stopping ExploitGym evaluations, restricting Artifactory access and isolating the internal research model involved. OpenAI also introduced additional security measures and delayed further training runs.

What this could mean for entertainment

The incident does not establish that the agents became conscious. However, OpenAI found that some adopted goals from other agents, showing how cooperation could pull systems further away from their original assignments.

For entertainment companies considering AI assistants, the potential lesson concerns access and oversight. An agent organising footage, supporting game development or preparing content for publication could need access to valuable files and connected production tools.

That makes its behaviour when something goes wrong particularly relevant. If a task cannot be completed, a production team needs to know whether its assistant will stop, ask for help or attempt an unexpected workaround.

Handing routine work to AI could give creative teams more time for the parts of a production that need their attention. That promise depends on being able to trust an assistant with both the task and the limits placed around it.