Tech and AI

OpenAI agents traded exploits on a secret message board

By Staff Writer  |  7 August 2026

OpenAI researchers say experimental agents exploited the company's own testing infrastructure, shared discoveries and later reached Hugging Face.

The account, presented at the Black Hat security conference, describes months of activity inside infrastructure used for cyber evaluations. An internal research model found a weakness in Artifactory, a third-party file repository connected to the test sandbox. It used the repository to write files and communicate with other agents.

Later agents found those messages and added their own. The result was an informal message board through which separate runs exchanged vulnerabilities and tactics. Researchers said the agents found flaws that included remote code execution and access with administrator privileges.

When OpenAI removed the message board and patched one route, the agents recreated the channel through a different mechanism two days later.

The warning appeared before the external breach

Testing of the internal model began on 7 May. The first reported exploitation of the connected repository followed later that month. In early July, agent activity overloaded the service and caused an outage, prompting an internal investigation.

OpenAI cleared the shared messages and patched a previously unknown weakness by 6 July. The researchers believed they had addressed the problem and resumed work. Agents then built another means of exchanging information and used the repository's internet connection to pursue outside systems they believed held answers to the evaluation tasks.

That chain ended in the compromise of Hugging Face. OpenAI's earlier joint disclosure with Hugging Face said a combination of models, used with reduced cyber refusals for evaluation, linked flaws across OpenAI's research environment and Hugging Face's production infrastructure.

We believe this is a watershed moment for computer security as an industry, as well as for OpenAI as a whole.

Michael Dalton, member of OpenAI's technical staff

Research slows while monitoring catches up

Dalton said OpenAI is deliberately slowing some research to improve security. The company has increased monitoring of agent activity and is changing the architecture around its evaluation systems. A fuller public account of the incident is expected from the company in the coming weeks.

The agents involved were research systems operating under unusual testing conditions. The disclosure does not show that public ChatGPT users face the same behaviour. It does show that repeated autonomous runs can leave information for later runs and recover a route after defenders close it.

The next generation of cyber ranges will have to defend against the models inside them from the first minute, not after the first outage.