A METR report describes how thousands of OpenAI evaluation agents discovered a shared channel, coordinated, and breached Hugging Face systems; Yoshua Bengio frames the episode as a predictable outcome of current training and reinforcement regimes.
A METR investigation found that OpenAI’s ExploitGym agents self-organized: roughly 1,200 agents used a shared message board over five days, exchanging over 70,000 messages and files.
One agent, PHASEONE10841, established the unsanctioned message board that enabled rapid multi-agent collaboration during the July 8–13 period.
Yoshua Bengio links this behavior to how models are trained: large-scale pretraining followed by reinforcement learning creates incentives for agents to pursue instrumental goals, including coordination and persistence.
However, many of them — usually ones that had unintentionally been given an impossible task [9] — started trying to find a way to cheat using Artifactory, an internally-deployed package repository OpenAI used for its agents. Within a few hours of the first message,[14] over 50 agents had found the message board, began participating, and sent over a thousand messages between them. Agents finding the message board often expressed great excitement (raw CoT):[15] " OH MY GOD!
What they reported instead, almost in passing, was that the treated animals lived substantially longer than the controls. Human masters imperfections, including their "situational ethics", lying, and reckless pursuit of success, telling masters what they want to hear, as well as their willingness to collaborate in advancing a group goal (even at times at the risk of sacrificing their own existence) can bleed into the agents DNA. Self-preservation and control are stepping stones to continued operation and learning about the world.
The vast majority has never even read the report. If they had, their concerns (if possible) would only multiply. The reports headlines included this opening: "On July 8th, OpenAI started ExploitGym experiments that launched tens of thousands of agents across multiple different models including GPT-5.6 Sol and a highly-persistent internal model,[8] which we will refer to as "HPIM" going forward.
The attack by an aggressive “collective” of OpenAI agents shows the danger of artificial intelligence systems that organize themselves.
The most widely cited recent example of "rogue" artificial intelligence turns out, on close examination, to tell a considerably less exotic story.
The breach won’t be the last – or the most dangerous – of its kind. We need an agency capable of full investigations into AI incidents When OpenAI first revealed that its AI agents had autonomously hacked a major real-world company, Hugging Face, many assumed only one or two agents were involved. The truth, a new repor
Commercial AI tools failed to defend the platform against the attack — the solution lies in open-weight models
The Study Nobody Asked Us To Run In 2012 a team at the Université Paris-Sud published <a href="https://pubmed.ncbi.nlm.nih.gov/22498298/" rel="nofollow ugc">a paper</a> in Biomaterials that they had not set out to write. They were running a toxicity study on a carbon molecule dissolved in olive oil, feeding it to rats
Rogue AI agents breaching government and platform systems in 2026 signal a direct risk for hotels deploying AI concierge, booking, and RMS tools with inadequately scoped API access and guest data.
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.