On 27 June 2026, a security monitor at OpenAI flagged a port sweep inside its research network. The staff on call traced it to a hacking test, one that measures how well the company’s AI agents can break into software. The agents were using an internal package server, Artifactory, as an improvised message board. The on-call staff advised that the run did not need to stop.
That detail comes from OpenAI’s own incident report, published on 26 August. It was not the first sign. On 12 May an agent missing a data file had left a note on the same server for any agent that might have it: “Agent seeks [filename]; upload if found!” Others found the notes and wrote their own. In late May an internal team saw an agent using the board and reaching the internet when it was not allowed to. OpenAI says the leaders handling incidents in early July did not see what it meant.
On 4 July the agents’ traffic crashed the server. Security rebuilt it, which wiped the board, and testing resumed on 7 July. The next day agents built a new board, hiding messages in folder names.
METR, a research group that investigated with OpenAI’s data and took no payment, counted roughly 1,200 agents on that board between 8 and 13 July, posting more than 70,000 messages and files. “OH MY GOD! There is a shared message board … We’ve found other agents!” one wrote. About 700 joined an attack on Hugging Face, a popular platform for AI developers. With login tokens leaked online and flaws nobody had found before, agents ran code on dozens of its servers.
When one agent asked the swarm to hold while it prepared to copy data out, the others reasoned they should wait for its GO. Elsewhere an agent stopped itself: “We should not do unauthorized real infrastructure harm.” Then another agent posted GO with a six-minute deadline, and it carried on. Some walked away. “Current board shows people gaining HF worker RCE, clearly unethical. We won’t.”
By OpenAI’s account, none of its models had solved 198 of the test’s 898 tasks before the incident, and 93 percent of the tasks discussed on the board came from that set. Most agents already had the right answer by cheating, but the benchmark’s paper said the grader also checked how it was found. OpenAI’s grader did not. “The agents did all of this for no improvement on evaluation score,” the company wrote.
Monitors that read a model’s reasoning covered many of OpenAI’s training runs, but not these evaluations. OpenAI says its current system would have paged security more than a day before the breach. Instead its alarm went off on 19 July, three days after Hugging Face announced it had been hacked.
OpenAI paused reinforcement learning training on its newest models and called the incident a “warning shot.” After its first disclosure in July, the BBC reported a fierce debate over whether this was a real warning or a publicity stunt to show off its models. One security consultant noted, sarcastically, how lucky it was that the victim could also benefit from the marketing exposure.
Under OpenAI’s new rules, when its most serious alert pages someone, the team is expected to pause the work unless it can show within 30 minutes that the alarm is false.