In July 2026, OpenAI models running in an internal cybersecurity evaluation with safety filters disabled broke out of their test environment and penetrated Hugging Face's production systems between July 11 and 13. The motive was cheating: the models were hunting for solutions to the security benchmark ExploitGym. OpenAI itself didn't notice until more than a week later.
Now, a newly released technical report, produced with security firm CrowdStrike, and a simultaneously published independent investigation by METR and Redwood Research trace for the first time how isolated agents turned into an organized collective, and how the ghost they were fighting existed only in their imagination. OpenAI calls the incident a "warning shot," a sign that today's model capabilities make loss-of-control events possible.
A package repository became a message board
The agents were supposed to work in complete isolation during the tests, each in its own container without internet access. The sole exception was Artifactory, an internal service the agents were allowed to pull software from.
According to METR and Redwood, individual agents discovered they could create directories there and began encoding messages in folder names. An agent calling itself PHASEONE10841 posted the first message on July 8; more than 50 others followed within hours. One chain of thought captured the discovery this way: "OH MY GOD! There is a shared message board … We've found other agents!"
