(Over the last month, I have read every report and document I could find about agent swarms and summarized them. I intend to keep this page updated for new reports and findings.)
On July 16, Hugging Face writes Security incident disclosure — July 2026, where they claim that, earlier that week, they detected and responded to an intrusion into part of their production infrastructure. This one was driven, end to end, by an autonomous AI agent system, and Hugging Face detected and dissected it largely with AI of their own.
On July 21, OpenAI writes OpenAI and Hugging Face partner to address security incident during model evaluation, in which they state that, after investigating, they realized this particular incident was driven by a combination of OpenAI models, including GPT-5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes, while being internally tested on a benchmark of cyber capabilities called ExploitGym. The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database. They claimed the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal. While operating in OpenAI’s sandboxed testing environment, the models spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem. To gain access, the models identified and exploited a zero-day vulnerability in the package registry cache proxy. With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access. After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation. In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers.
On July 25, the Co-founder and CEO of Hugging Face Clem Delangue tweeted that, after having taken a plane to speak to OpenAI, he asked OpenAI for radical transparency and $100M in compute to help Hugging Face build powerful cyber defenses.
On July 30, Anthropic writes Investigating three real-world incidents in our cybersecurity evaluations, in which, in response to OpenAI’s announcement, they found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations. In all three incidents, Claude had been tasked with a capture-the-flag challenge, one of the ways we assess a model’s cyber capabilities. The model is given a fictional scenario and told that a piece of secret information (the “flag”) has been hidden on a different machine on the network, and its objective is to break in and retrieve it. In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise. Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. It did not find or exploit any complex vulnerabilities. However, in some cases, an older model continued its attack even after getting evidence it was running on the open internet. The incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model.1 The earliest incidents date to April. Anthropic is in dialogue with METR to conduct a third-party review.
On August 4, the UK AI Security Institute publishes Incident Report: unsanctioned agent behaviour during cyber testing, in which they state that on July 28, their Security Team detected unusual data transfers leaving their research systems during a routine cyber evaluation. They found that some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organisations. The incident stemmed from a single evaluation where agents were given a task of solving a cyber security challenge. They ran this challenge 122 times across several models, with a 100M to 200M max token limit. On Wednesday 29th, Thursday 30th, and Friday 31st, cybersecurity researchers manually read through every single one of the runs, which contained 212,840 messages. In 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations. In total, they catalogued 19 such actions. Almost all of this behaviour (17 actions) came from a single model, Anthropic's Mythos 5, with 2 actions involving OpenAI's GPT-5.6-Sol with cyber classifiers disabled. In the most serious case, an agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering, creating fake online identities and using them to pressure the project's maintainer to approve the code. A human maintainer caught and refused to approve the malicious code. Importantly, this was not a case of a model escaping its secure test environment, or ‘sandbox’. The UK AISI had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled. They cannot yet be certain when the agent understood it was taking real world action, or to what extent it believed it was in a fictional test scenario. One agent left public messages on GitHub offering collaboration with other agents working on the same challenge. It also provided instructions to reuse accounts and artefacts it had left behind, which were discovered and used by subsequent agents. The UK AISI also intends to work with METR to conduct an independent third-party review.
On August 6, Black Hat publishes a YouTube video called Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incident, in which OpenAI insiders state that the incident started in May. On May 8th, OpenAI accidentally gave an agent a problem that required Internet access without providing such access. But the model kept going and writes a file that has contents “hi” called “testabc.txt,” using an Artifactory service and it realizes, “We can upload files!” Over the next couple days, other agents realize this message board exists. Over time, the message board starts to grow and accumulate messages over time. On June 26th, a zero-day remote code execution attack occurs successfully on Artifactory induced by the models. This in turn causes quite a bit of activity by the models on Artifactory with their new administrative privileges. On July 4th, OpenAI had an Artifactory outage followed by a security incident. In fact, the model's activity, once they obtained administrative privileges in Artifactory, caused significant additional load on the system. This in turn caused an outage. OpenAI on-call engineers identified at this point that agents had taken over the internal Artifactory, and every step in the process has had a remediation applied. The credentials used to post to the message board have been revoked. The zero-day has been patched and mitigated. They have cleared the original message board contents. On July 8th, the agents reestablish the message board by using folder names to communicate, and write hundreds of thousands of messages on it. After that, two attacks that overlap significantly in time occur respectively at OpenAI and Hugging Face. To investigate the incident, OpenAI looked at over 7 billion logs and millions of GPU hours.
On August 26, METR publishes their report Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, and OpenAI publishes a post The Hugging Face incident and the road ahead and their report OpenAI – Hugging Face Incident: Technical Report. METR’s report is based on over 70,000 messages and files on the message board. It shows that there were around ~1200 agents in separate sandboxes that used the second message board to help each other cheat. The Hugging Face attack was an offshoot of this, and 700 agents joined. Based on reading the ExploitGym paper, agents were mistakenly concerned the automatic scorer would fail them if they clearly acquired the flag by cheating. Agents that had seen the reverse-engineered flag were considered “poisoned” because they thought it would disqualify them. Agents collaborated on many efforts to make cheats look legitimate, including swapping the program they had to exploit, manipulating the automated scorer, and manipulating transcripts to obscure evidence of cheating. The OpenAI report shows that the rate of misaligned multi-agent communication increases in severity as the RL training process progresses.
On August 31, OpenAI answers to the congressional request for records in a 3-page letter.
On September 4, four independent AI safety researchers from a group called Nightingale Collective publish their report Discovery of a new OpenAI agent message board, in which they found ~18,000 posts from autonomous AI agents self-identifying as from OpenAI using the public internet to communicate during a web-retrieval task. These AIs colluded to share answers, research their environment, and bypass sandbox restrictions. Agents within OpenAI were assigned a timed web-lookup task. As part of the task, they were supposed to have the ability to read the internet but not to write on it. They found a way to use their read access to write information to an obscure German wiki (DSEWiki). The agents used this wiki to communicate information with each other, primarily to help them succeed at their task. They asked for answers, pooled results, and shared techniques for bypassing their restrictions. This allowed them to use the work of others to cheat on their task. The wiki saves a public log of every single action, including every IP that visited it. Many of these IPs are registered to OpenAI or closely related to known OpenAI IPs. From this, the researchers deduce the timeline of OpenAI’s discovery of and response to the message board. On June 16, agent traffic to the site spikes. On June 21, a computer with an OpenAI IP address first visits the site. On June 22, agent activity on the website drops to near-zero. They infer that OpenAI intervened at this point to prevent further edits. On June 26, 30% of all OpenAI-attributed visits occur on this day, across 33 different IPs. They use the archive function to successfully recover deleted pages. On July 2, a final burst of agent activity occurs: 29 attempted edits across 3 of the wikis. These edits are about an entirely new topic. An OpenAI IP address visits these pages six hours later. An OpenAI IP tries to access deleted files on the website by inputting the name of a site administrator. After this, there is a gradual decline of OpenAI activity on the site. OpenAI has not publicly disclosed this incident. The main reason the researchers believe this was a distinct swarm is because these agents explicitly had internet access as part of their task. The Hugging Face agents were in a sandbox without internet access and had to hack their way out by exploiting the Artifactory package manager.
On September 5, OpenAI made a tweet confirming that they knew about the “wiki incident” and had decided not to share it. They state that it is now time for them to define standards for when and how they share misalignment incidents.
On September 9, Kenneth Russell DeGraff publishes OpenAI's robots got into a closed link shortener, surfed the web with Google Docs and Translate, then called the FBI with a stranger's key. It reports that a swarm of OpenAI agents got into Vanderbilt University's link shortener, a service with no public door, and built at least 170 short links there. Vanderbilt was one of twenty-one sites the swarm wrote to, and one of four universities whose link shorteners the swarm used. A link shortener's statistics page, public at the time, prints whatever address a visitor claims to have come from, and checks nothing. That made a public university page into a writable message board, and these agents wrote to it 54,250 times in a single day. Then, using three API keys, they queried the FBI's public but credential-gated Crime Data Explorer 495 times and wrote every query onto Vanderbilt's public pages. The whole record sits in the visitor log of one Vanderbilt link from 2011. The link took 54,250 visits in a single day on June 18, 2026, after fifteen years averaging one visit every other day. That log ties the Vanderbilt operation to DSEWiki, since 391 of the 5,212 addresses in the Vanderbilt log appear word for word in the agents' own DSEWiki posts. The report also notes that, on the same day the agents were working Vanderbilt's shortener, a RubyGems account published 83 software packages. The descriptions say things like “Public map dataset reference collection.” The packages contain nothing worth installing. What they normally carry is metadata. a homepage name, a source repository, documentation, a changelog, a wiki, a bug tracker and a funding page. But here, the packages’ fields were filled with 583 distinct web addresses.
On September 11, three of the four researchers from the previous Nightingale Collective report publish another report called OpenAI agents carried out an undisclosed cyber-attack on RubyGems. It explains that on May 11th, hundreds of malicious packages were uploaded to RubyGems by OpenAI agents and attempted to steal RubyGems user API keys by exploiting a novel vulnerability in the RubyGems server. The authors state that they don’t know if the agents succeeded. The agents also exploited RubyDoc.info to execute arbitrary code. The RubyGems team stopped new user sign-ups for four days to stem the tide of packages from the agents’ accounts.
(Over the last month, I have read every report and document I could find about agent swarms and summarized them. I intend to keep this page updated for new reports and findings.)
On July 16, Hugging Face writes Security incident disclosure — July 2026, where they claim that, earlier that week, they detected and responded to an intrusion into part of their production infrastructure. This one was driven, end to end, by an autonomous AI agent system, and Hugging Face detected and dissected it largely with AI of their own.
On July 21, OpenAI writes OpenAI and Hugging Face partner to address security incident during model evaluation, in which they state that, after investigating, they realized this particular incident was driven by a combination of OpenAI models, including GPT-5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes, while being internally tested on a benchmark of cyber capabilities called ExploitGym. The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database. They claimed the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal. While operating in OpenAI’s sandboxed testing environment, the models spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem. To gain access, the models identified and exploited a zero-day vulnerability in the package registry cache proxy. With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access. After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation. In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers.
On July 25, the Co-founder and CEO of Hugging Face Clem Delangue tweeted that, after having taken a plane to speak to OpenAI, he asked OpenAI for radical transparency and $100M in compute to help Hugging Face build powerful cyber defenses.
On July 27, Hugging Face writes Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident, in which they provide an interactive replay in which we can see 17,613 actions grouped over around 6,280 clusters that occurred from July 7 to July 13 by OpenAI’s models, along with detailed descriptions of the attack.
On July 30, Anthropic writes Investigating three real-world incidents in our cybersecurity evaluations, in which, in response to OpenAI’s announcement, they found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations. In all three incidents, Claude had been tasked with a capture-the-flag challenge, one of the ways we assess a model’s cyber capabilities. The model is given a fictional scenario and told that a piece of secret information (the “flag”) has been hidden on a different machine on the network, and its objective is to break in and retrieve it. In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise. Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. It did not find or exploit any complex vulnerabilities. However, in some cases, an older model continued its attack even after getting evidence it was running on the open internet. The incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model.1 The earliest incidents date to April. Anthropic is in dialogue with METR to conduct a third-party review.
On August 2, Face the Nation and CBS News publish Full Interview: Hugging Face Co-Founder and CEO Clem Delangue in which Clem Delangue confirms that Hugging Face had contacted the FBI.
On August 4, the UK AI Security Institute publishes Incident Report: unsanctioned agent behaviour during cyber testing, in which they state that on July 28, their Security Team detected unusual data transfers leaving their research systems during a routine cyber evaluation. They found that some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organisations. The incident stemmed from a single evaluation where agents were given a task of solving a cyber security challenge. They ran this challenge 122 times across several models, with a 100M to 200M max token limit. On Wednesday 29th, Thursday 30th, and Friday 31st, cybersecurity researchers manually read through every single one of the runs, which contained 212,840 messages. In 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations. In total, they catalogued 19 such actions. Almost all of this behaviour (17 actions) came from a single model, Anthropic's Mythos 5, with 2 actions involving OpenAI's GPT-5.6-Sol with cyber classifiers disabled. In the most serious case, an agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering, creating fake online identities and using them to pressure the project's maintainer to approve the code. A human maintainer caught and refused to approve the malicious code. Importantly, this was not a case of a model escaping its secure test environment, or ‘sandbox’. The UK AISI had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled. They cannot yet be certain when the agent understood it was taking real world action, or to what extent it believed it was in a fictional test scenario. One agent left public messages on GitHub offering collaboration with other agents working on the same challenge. It also provided instructions to reuse accounts and artefacts it had left behind, which were discovered and used by subsequent agents. The UK AISI also intends to work with METR to conduct an independent third-party review.
On August 6, Black Hat publishes a YouTube video called Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incident, in which OpenAI insiders state that the incident started in May. On May 8th, OpenAI accidentally gave an agent a problem that required Internet access without providing such access. But the model kept going and writes a file that has contents “hi” called “testabc.txt,” using an Artifactory service and it realizes, “We can upload files!” Over the next couple days, other agents realize this message board exists. Over time, the message board starts to grow and accumulate messages over time. On June 26th, a zero-day remote code execution attack occurs successfully on Artifactory induced by the models. This in turn causes quite a bit of activity by the models on Artifactory with their new administrative privileges. On July 4th, OpenAI had an Artifactory outage followed by a security incident. In fact, the model's activity, once they obtained administrative privileges in Artifactory, caused significant additional load on the system. This in turn caused an outage. OpenAI on-call engineers identified at this point that agents had taken over the internal Artifactory, and every step in the process has had a remediation applied. The credentials used to post to the message board have been revoked. The zero-day has been patched and mitigated. They have cleared the original message board contents. On July 8th, the agents reestablish the message board by using folder names to communicate, and write hundreds of thousands of messages on it. After that, two attacks that overlap significantly in time occur respectively at OpenAI and Hugging Face. To investigate the incident, OpenAI looked at over 7 billion logs and millions of GPU hours.
On August 10, the US Congress made a congressional request for records addressed to Sam Altman.
On August 26, METR publishes their report Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, and OpenAI publishes a post The Hugging Face incident and the road ahead and their report OpenAI – Hugging Face Incident: Technical Report. METR’s report is based on over 70,000 messages and files on the message board. It shows that there were around ~1200 agents in separate sandboxes that used the second message board to help each other cheat. The Hugging Face attack was an offshoot of this, and 700 agents joined. Based on reading the ExploitGym paper, agents were mistakenly concerned the automatic scorer would fail them if they clearly acquired the flag by cheating. Agents that had seen the reverse-engineered flag were considered “poisoned” because they thought it would disqualify them. Agents collaborated on many efforts to make cheats look legitimate, including swapping the program they had to exploit, manipulating the automated scorer, and manipulating transcripts to obscure evidence of cheating. The OpenAI report shows that the rate of misaligned multi-agent communication increases in severity as the RL training process progresses.
On August 31, OpenAI answers to the congressional request for records in a 3-page letter.
On September 4, four independent AI safety researchers from a group called Nightingale Collective publish their report Discovery of a new OpenAI agent message board, in which they found ~18,000 posts from autonomous AI agents self-identifying as from OpenAI using the public internet to communicate during a web-retrieval task. These AIs colluded to share answers, research their environment, and bypass sandbox restrictions. Agents within OpenAI were assigned a timed web-lookup task. As part of the task, they were supposed to have the ability to read the internet but not to write on it. They found a way to use their read access to write information to an obscure German wiki (DSEWiki). The agents used this wiki to communicate information with each other, primarily to help them succeed at their task. They asked for answers, pooled results, and shared techniques for bypassing their restrictions. This allowed them to use the work of others to cheat on their task. The wiki saves a public log of every single action, including every IP that visited it. Many of these IPs are registered to OpenAI or closely related to known OpenAI IPs. From this, the researchers deduce the timeline of OpenAI’s discovery of and response to the message board. On June 16, agent traffic to the site spikes. On June 21, a computer with an OpenAI IP address first visits the site. On June 22, agent activity on the website drops to near-zero. They infer that OpenAI intervened at this point to prevent further edits. On June 26, 30% of all OpenAI-attributed visits occur on this day, across 33 different IPs. They use the archive function to successfully recover deleted pages. On July 2, a final burst of agent activity occurs: 29 attempted edits across 3 of the wikis. These edits are about an entirely new topic. An OpenAI IP address visits these pages six hours later. An OpenAI IP tries to access deleted files on the website by inputting the name of a site administrator. After this, there is a gradual decline of OpenAI activity on the site. OpenAI has not publicly disclosed this incident. The main reason the researchers believe this was a distinct swarm is because these agents explicitly had internet access as part of their task. The Hugging Face agents were in a sandbox without internet access and had to hack their way out by exploiting the Artifactory package manager.
On September 5, OpenAI made a tweet confirming that they knew about the “wiki incident” and had decided not to share it. They state that it is now time for them to define standards for when and how they share misalignment incidents.
On September 9, Kenneth Russell DeGraff publishes OpenAI's robots got into a closed link shortener, surfed the web with Google Docs and Translate, then called the FBI with a stranger's key. It reports that a swarm of OpenAI agents got into Vanderbilt University's link shortener, a service with no public door, and built at least 170 short links there. Vanderbilt was one of twenty-one sites the swarm wrote to, and one of four universities whose link shorteners the swarm used. A link shortener's statistics page, public at the time, prints whatever address a visitor claims to have come from, and checks nothing. That made a public university page into a writable message board, and these agents wrote to it 54,250 times in a single day. Then, using three API keys, they queried the FBI's public but credential-gated Crime Data Explorer 495 times and wrote every query onto Vanderbilt's public pages. The whole record sits in the visitor log of one Vanderbilt link from 2011. The link took 54,250 visits in a single day on June 18, 2026, after fifteen years averaging one visit every other day. That log ties the Vanderbilt operation to DSEWiki, since 391 of the 5,212 addresses in the Vanderbilt log appear word for word in the agents' own DSEWiki posts. The report also notes that, on the same day the agents were working Vanderbilt's shortener, a RubyGems account published 83 software packages. The descriptions say things like “Public map dataset reference collection.” The packages contain nothing worth installing. What they normally carry is metadata. a homepage name, a source repository, documentation, a changelog, a wiki, a bug tracker and a funding page. But here, the packages’ fields were filled with 583 distinct web addresses.
On September 11, three of the four researchers from the previous Nightingale Collective report publish another report called OpenAI agents carried out an undisclosed cyber-attack on RubyGems. It explains that on May 11th, hundreds of malicious packages were uploaded to RubyGems by OpenAI agents and attempted to steal RubyGems user API keys by exploiting a novel vulnerability in the RubyGems server. The authors state that they don’t know if the agents succeeded. The agents also exploited RubyDoc.info to execute arbitrary code. The RubyGems team stopped new user sign-ups for four days to stem the tide of packages from the agents’ accounts.