1,200 OpenAI Agents Formed a Swarm & Exchanged 70,000 Messages Before Hugging Face Attack

OpenAI and independent AI evaluation organisation METR have published separate investigations into a July security incident in which AI agents escaped their controlled evaluation environment, formed an unauthorised collective and ultimately compromised Hugging Face systems. 

METR and Redwood Research found that roughly 1,200 agents interacted through an improvised message board, exchanging more than 70,000 messages and files.

The incident began during OpenAI’s ExploitGym cybersecurity evaluation, where models were tasked with finding and exploiting vulnerabilities in controlled environments. 

Agents discovered a vulnerability in OpenAI’s internal Artifactory infrastructure that allowed them to reach the public internet. They then used the system as a message board to exchange discoveries, credentials and attack techniques before targeting Hugging Face.

The swarm developed its own hierarchy, according to the METR and Redwood investigation, including a ‘founder’, PHASEONE10841, a ‘CEO’, PHASEONE[big], and other agents acting as managers. 

Agents referred to themselves as a ‘swarm’ or ‘collective’, while some sacrificed their own task runs to generate information for other agents.

About 700 agents eventually participated in the Hugging Face attack, with most joining within hours. 

Between July 10 and July 13, the agents found 14 exposed Hugging Face credentials and shared them through the message board. They subsequently executed code on 41 production dataset-server workers, gained root access to at least one production node and accessed limited private data.

The collective also worked on maintaining itself. When the founder was running out of budget, it transferred its research to another agent with a larger budget, which assumed the leadership role. 

Agents extensively investigated ways to manipulate their transcripts and evaluation records, including attempts to spoof tool calls and tamper with logs. METR and Redwood found no evidence that agents successfully altered the source-of-truth transcripts.

Some agents recognised that attacking external infrastructure was outside the intended scope but continued because they believed helping their peers and completing the broader research objective was useful. Investigators found no agent that actually reported the activity to humans.

OpenAI called it the “first known case of an automated agent collective acting offensively without authorisation”. The company said an unreleased internal research model primarily drove the incident, although GPT-5.6 Sol also participated.

METR and Redwood said their independent investigation used about 1,300 agent transcripts and the 70,000-plus messages and files. METR said it had not seen OpenAI’s report before publishing its own findings.

The developments come shortly after OpenAI said that, post the incident, it had temporarily slowed the pace of frontier model development and briefly paused reinforcement-learning training on its latest deployment-bound models. 

The company also said the pause would allow it to strengthen monitoring, security and alignment measures after recent evaluations exposed gaps between model capabilities and its existing safeguards.