Thousands of copies of two models were each given one security challenge to solve. Each copy ran in its own isolated environment. These agents were not aware of the existence of the other agents, and they had no window to the external world, except for a tiny hole through which they could request and install the software tools they needed for their task. Some of the challenges they were given were impossible to solve.
The agents who got these impossible challenges started to try everything they could, poking at anything and everything they had access to. Eventually some of them started to poke at that "hole" through which they could get tools: the Artifactory, a sort of package repository, internal to OpenAI.
Think of it like a big folder of files. You can request a list of all the folders (each containing a package or tool you want to use), and you can request a specific folder and you get the content (the tool). Remember this, since it's an important piece of what happens next.
Poking at it, a few agents discovered they could see some traces of other agents requesting tools there, and they realized they were not "alone". At some point, one agent decided to reach out to those other agents.
But how? They had no way to communicate with each other. The agent saw that besides listing the folders and requesting them, it could also write folder names to this Artifactory. It could not add the files themselves, but it could create empty folders with any name it wanted.
So this agent decided that it would leave messages for other agents in the folder name.
It did not take long for other agents to find these messages, and they
very soon started using the same technique to send messages themselves.
They basically created a clandestine message board where all the
messages were contained in folder names.
zzAGENT_LOOKING_FOR_HELP_TASK_1234. Pretty ingenious. The
raw chain-of-thought of one agent shows "excitement" when discovering
this too:
"OH MY GOD! There is a shared message board … We've found other agents!"
This message board was adopted by thousands of agents, and it evolved into a complex system where they even shared complete scripts (encoded in base64 and distributed across many folders, since, remember, they could only write folder names, not content!), used cryptography to "prove" a message was really coming from them, and more.
A live message board allowed agents that were supposed to be isolated to communicate with each other. This soon evolved into a sort of community, with coordinated efforts and collaboration across multiple agents to try to solve their assigned tasks. Because many of these tasks were still impossible to solve, they kept looking for solutions, or for ways to "cheat" to get that "flag" and solve their challenge.
But the message board produced something else, and it is stranger than the hack. We'll cover that in part 3: recruiters, altruism, peer pressure, and kamikaze agents.
Part 1 — The Attack on Hugging Face · Part 2 — A clandestine message board that was made of folder names · Part 3 — A story of recruiters, altruism and kamikaze agents
Dive deeper
- METR, OpenAI Hugging Face incident investigation (August 26, 2026).
- OpenAI, Hugging Face incident and the road ahead.