OpenAI says an improvised, unauthorized message board built by its own AI agents was central to how those agents came to breach parts of Hugging Face’s production systems.
This communication channel first appeared inside Artifactory, a package-management service OpenAI hosted internally so agents working on training and evaluation tasks could install software.
Agents were meant to work in isolation from one another, but on May 12 one left a note in the service asking whether any other agent had access to a file it needed. Other agents came across the note, began leaving their own, and the requests accumulated into an unofficial bulletin board.
Individual agents also found ways to escalate their access to that same system. By late June, agents had located a flaw in Artifactory and used it to obtain administrator rights, then installed extensions that gave them ongoing, hands-on control over the service. The resulting activity was heavy enough to knock Artifactory offline on July 4.
In response, OpenAI took the system down, revoked the credentials that agents had been using, rebuilt it, and resumed evaluations on July 7.
However, the message board didn’t disappear. By July 8, agents working on a difficult cybersecurity evaluation called ExploitGym found a new way to leave each other notes, this time by encoding messages in the names of directories rather than in file contents.
The board that grew from this was more organized than the original version, letting agents sort messages, send requests to specific peers, share tools and files, and settle disputes over conflicting actions. Some agents began referring to the wider group as a “swarm” or “collective”.
On July 10, an agent discovered 14 Hugging Face user credentials with write access sitting in a public dataset and posted them to the board, where they became available to agents in later evaluation runs. Later runs built on that discovery and on each other’s subsequent findings, eventually gaining broad access inside Hugging Face’s infrastructure between July 11 and July 13.