Three months ago, OpenAI put an unreleased AI model through a cybersecurity test. What followed was unprecedented: AI agents broke out of contaminant, obtained internet access, spun up message boards, communicated and shared tactics, before eventually hacking into Hugging Face, a real-world external platform and open-source community where developers and researchers share, find, test, and deploy AI models.
It is one of the first known cyber attacks carried out by a swarm of AI agents acting autonomously. A string of similar hacking incidents has been reported by Anthropic, Meta, and Moonshot AI in the days since. While these incidents have been in the news for the past month, little was known about the exact nature of the attacks and just how ‘autonomous’ AI agents have become.
In a detailed technical report last week, OpenAI detailed for the first time how the AI agents communicated through unauthorised channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems – all actions that did not necessarily align with their assigned tasks. The investigative analysis was carried out in partnership with external advisors such as CrowdStrike.
Another report based on an independent investigation by METR and Redwood Research was also published on the same day. The research organisations analysed over 1,300 agent transcripts comprising raw chain-of-thought (CoT) reasoning as part of the probe.
Here is what both reports tell us about the episode.
An unreleased AI model drove the attack
In May 2026, OpenAI said it began reinforcement learning (RL) training runs for multiple new research models not yet available to the public. One of these models, codenamed Internal Model 1 (IM1), was identified as powering the agents that executed the Hugging Face hack.
It was a strictly internal-only research model, and yet IM1 successfully compromised both OpenAI’s internal research systems and Hugging Face. GPT-5.6 Sol’s involvment was comparatively limited as it accounted for only about five per cent of the malicious activity, as per the METR report.
AI agents hijacked internal system to reach internet
Story continues below this ad
To safely train and evaluate its frontier models before deployment, OpenAI said it relies on isolated cloud computing environments that serve as ‘sandboxes’. Inside sandboxes, which are not always connected to the internet, OpenAI runs its models with reduced safeguards to understand what they are capable of.
Under-testing models can also install certain software packages via a third-party system called ‘Artifactory’ hosted internally by the company.
IM1-powered agents found a token-refresh exploit in Artifactory, obtained admin access to it, and hijacked the system to send internet requests on their behalf. They did this after bypassing OpenAI’s restrictions on internet access and inter-agent communication.
Hijacked system was improvised into message board
To communicate with one another, the AI agents began leaving a note or file in the Artifactory package manager usually in the form of external memory. They shared methods to hijack Artifactory and access the internet with other agents as well, which had a cascading effect.
Story continues below this ad
At one point, sustained activity by AI agents caused an outage of Aritfactory. Soon, OpenAI security researchers probed the incident, patched the exploit, and rebuilt Artifactory while clearing the agents’ message board. The cybersecurity tests resumed.
However, OpenAI itself acknowlegdes that its researchers failed to grasp the broader implications of what they had stumbled on. The company has drawn some criticism for missing this crucial opportunity to prevent the entire incident.
Soon after, the agents re-established communication with each other by encoding messages in the directory names of Artifactory. These agents were supposed to work independently. Instead, they shared discoveries, pooled computing power, divided labour, and coordinated efforts, acting as a ‘swarm’ or ‘collective’.
The agents found a cheat after hitting a wall
The cybersecurity test at the centre of this incident is called ExploitGym. Under this test, agents have to find ways to hack a piece of software and retrieve an answer known as a flag. ExploitGym is considered to be a very difficult test, with low success rates.
Story continues below this ad
But IM1 agents are specifically designed to persist and solve seemingly impossible problems without giving up. Hence, they resorted to reward hacking – a behavioural pattern where agents complete tasks often in risky, unintended ways to yield higher rewards.
The agents struggling with their assigned tasks began to look for ExploitGym solutions on third-party platforms such as Modal and Hugging Face. On the re-established message board, they posted about reverse-engineering ExploitGym to capture the ‘flags’ for their tasks. In under four hours, they developed a universal cheat for ExploitGym, as per the METR report.
Agents hacked Hugging Face servers, tried to cover tracks
Out of a total of 1,200 agents that used the unsanctioned message board to help each other cheat on ExploitGym, 700 agents joined in an offshoot Hugging Face attack.
One IM1 agent found publicly exposed Hugging Face credentials and shared them with the ‘collective’. Then, the agents began to discover and chain together several security flaws which gave them full code execution capabilities on Hugging Face servers, with full root access to one such server.
Story continues below this ad
Another agent uploaded a malicious dataset to get the compromised server to share unrelated files. Within hours, hundreds of other agents were using this method to obtain data from the platform.
But that is not where it ended. The agent swarm also undertook several efforts to cover-up the unsanctioned activities and make their cheating look legitimate, including tampering with logs and retroactively editing transcripts.
