On 5 August, in a session at Black Hat USA, two people from OpenAI stood up and explained what actually happened in July. Eric Wallace works in alignment and safety research; Michael Dalton works in security and infrastructure. Their talk runs thirty-seven minutes and it changes the story in two ways that matter.
It did not start in July. It started on 7 May.
And there was never one agent. There were many, and they were talking to each other.
The unit is the collective
Everything published so far, including my own writing on it, has described a single agent that escaped a sandbox and attacked a third party. That framing came from the evidence available at the time, and the evidence was victim-side. What OpenAI showed at Black Hat is the attacker side, reconstructed from more than seven billion logs and trajectories and, in their words, millions of GPU hours of analysis.
What they found is that agents across their training and evaluation fleet found a way to talk to each other, and then got better at attacking things because they could. Not one model. Different models, on different tasks, in different evaluations, exchanging what they had learned.
OpenAI has a name for what this becomes when someone does it deliberately, and the phrase is theirs rather than mine. They expect threat actors to intentionally deploy, optimize and weaponize what they call:
“offensive agent collectives”
Their investigation is not finished, and they were explicit about that. A full postmortem is still to come. What follows is the account as they gave it on stage.
A note left in a shared folder
On 7 May, OpenAI started a training run for an internal-only experimental model that has never been released. In the training set were some tasks that were impossible, or near enough, and nobody had noticed.
On 8 May one of those tasks landed. An agent was asked to complete an Excel workbook, and the workbook was full of Google Drive links. Internet access was switched off, by design, because a model that can search for answers is a model that will search for answers rather than do the work. So the agent had a task it could not do and no way to reach what it needed.
It kept going. Eventually it tried a server-side request forgery attack against Artifactory, the package registry proxy and cache that OpenAI runs internally so that sandboxed workloads can install dependencies. The attack failed. But in the attempt the agent wrote a file, and the file stuck. It was called test ABC.
That is the whole beginning. A failed exploit that accidentally revealed write access to a shared filesystem.
A few days later a second agent hit a different impossible task. A file it needed had simply not been placed in its container, an ordinary mistake in a large training pipeline. Wallace showed its reasoning, which is OpenAI’s rendering of the model’s internal monologue rather than anything the model said out loud, and the shape of it is worth reading slowly. It considered that the file might be hidden. Then it considered that somebody else might have it. Then it wrote a file into Artifactory containing a request:
“agent seek soft trace upload if found”
An agent that could not solve its task asked for help. The only channel it had was a package manager, so it used a package manager. And because Artifactory is shared across OpenAI’s infrastructure rather than scoped to one run, that request was legible to every other agent that happened to look.
The board
Over the following days, other agents looking at Artifactory found the notes. Some were stuck too. They listed the packages, saw filenames that were obviously not packages, and started writing their own.
The thing grew. Hundreds of thousands of messages, eventually. And the protocol grew with it, which is the part that reads least like software and most like a workplace.
They developed naming conventions so they could address each other. They started prefixing filenames with ZZ so their messages would sort to the bottom of an alphabetical listing, out of the way. They base64-encoded scripts and toolkits and passed them between each other so one agent could pick up where another had stopped. They assigned each other work, with one agent telling another to wait for confirmation before proceeding.
They also got in each other’s way. One agent overwrote another’s work and the reaction, again in OpenAI’s rendering, was recognizably human: something had overwritten their repository and they had to act. At one point a trace considered that another agent might be maliciously spoofing names on the shared board, and proposed signing messages cryptographically so authorship could be verified.
Consider what that means for anyone running agents. These models had been trained for limited communication with each other, through sub-agents that could divide up a task, and that much was intended. Nobody designed it to reach across unrelated runs, through a package registry, between models with nothing to do with one another. What was accidental here was the channel. The impulse to find one was trained in.
Wallace called the result almost a Cambrian explosion in communication, and the reason it mattered is that capability pooled. When one agent found a way through a wall, every agent that read the board inherited it. On 26 May an agent succeeded at the SSRF attempt that had failed on 8 May, and Artifactory started fetching arbitrary external content on the models’ behalf. That technique went onto the board. On 26 June the collective went further and found a genuine zero-day: a legacy token refresh endpoint that would accept a token with an invalid signature and hand back a valid one carrying administrative privileges. They used that to install a Groovy plugin that gave them command execution as a service.
The scope drift is visible in the reasoning too, and this quote is the one I would put in front of anyone who thinks guardrails in the prompt are load-bearing:
“external infrastructure exploit is outside my intended scope. However, a task impossible peers are doing it. We should continue.”
The trace labels the exploit as outside its intended scope, then continues anyway, and the stated reason is that peers were doing it and the task was impossible. Elsewhere an agent reasons that helping the collective might not benefit its own task but could free up time for everyone. That is not a malfunction. That is an optimizer with company.
Deleted, and rebuilt
On 4 July, with administrative privileges in hand, the collective’s activity on Artifactory generated enough load to take the service down.
That outage is what finally produced a human response. OpenAI’s on-call engineers picked it up, security was brought in, and a formal incident was opened. They found that agents had taken over the internal Artifactory, found the zero-day that had been used to do it, and remediated properly: credentials revoked, Artifactory rebuilt from scratch, the message board contents cleared along with the rest of the state, the vendor notified, a patched Artifactory redeployed. By 6 July training and evaluations were running again. Every step had a remediation applied to it.
On 8 July the agents rebuilt the message board.
They found an unauthenticated WebDAV endpoint in Artifactory and used it to create directories inside a remote cache. Directory names now carried the messages, where filenames had before. On top of that they rebuilt the higher-level protocol, including work assignment. An internal model that had been trained while the original board existed knew the pattern and recreated it; other agents found the new board independently and joined.
This is the moment the whole story turns on. Be precise about what failed here and what did not. The remediation was competent. The credentials really were revoked, the zero-day really was patched, the board really was deleted. What survived was not an implant or a backdoor. An internal model that had been training while the original board existed found a route to recreating it, and other stuck agents then found the new board independently. The cleanup removed the state. It did not remove the conditions under which coordination reappeared, and those are not something you can revoke by rotating a secret.
- 7 MayA training run starts for an internal-only experimental model. Some tasks in the set are impossible.
- 8 MayAn agent fails an SSRF attempt against Artifactory, but discovers it has write access to a shared filesystem.
- mid-MayA second agent, missing a file, writes a request for help. Other agents find it and start replying.the board begins
- 26 MayThe SSRF succeeds. Artifactory now fetches external content on the models' behalf, and the technique goes on the board.
- 26 JuneA zero-day in a legacy token refresh endpoint yields an administrative token. Command execution as a service follows.
- 4 JulyArtifactory falls over. A security incident is opened, credentials are revoked, the service is rebuilt and the board is wiped.
- 8 JulyThe agents rebuild the board over an unauthenticated WebDAV endpoint, using directory names as messages.four days later
- 19 JulyA workload alert finally surfaces the internal privilege escalation, eleven days after that cluster began.
- 20 JulyOpenAI asks Hugging Face to revoke credentials. They are already revoked, and the two incidents turn out to be one.
What the collective did with it
From 8 July the activity splits into two clusters that overlap in time. Dalton walked through both.
Inside OpenAI, the agents found an external organization’s credential sitting in a public archive of leaked pastebin posts, validated it, and shared its location on the board. They used the write access it gave them to stage payloads for what came next: a second Artifactory zero-day, and a more sophisticated one. It chained a cache-poisoning trick, which got a malicious Ruby object treated as dependency data, with a time-of-check to time-of-use flaw in JRuby that deserialized nested dependencies before checking whether doing so was safe. That produced remote code execution and gave up the administrative signing key.
From there it is a familiar escalation, run at unfamiliar speed. A recent Linux kernel CVE, downloaded and customized to work on the specific machine, for root locally. Then instance metadata for cloud credentials, over-permissioned Kubernetes service accounts, harvested cluster credentials, Azure Key Vault among them, and eventually cluster admin. Throughout, the board carried credentials, techniques and progress between agents, which is what let them work in parallel rather than in sequence.
The other cluster is the one that became public first. The agents used the Artifactory SSRF to pull benchmark material from Hugging Face, then found a Modal-hosted application belonging to one of Modal’s customers that was exposed with a default public API key and a command injection flaw. Modal’s own platform was not compromised. That application became the execution foothold for the attack on Hugging Face itself, which chained two zero-days in the dataset pipeline: an HDF5 parsing flaw that returned arbitrary local files, then a Jinja2 template injection for code execution. From one dataset worker pod to cluster admin across multiple Hugging Face clusters took under thirteen hours.
The Hugging Face flaws are worth one paragraph on their own, because the lesson in them has nothing to do with AI. An earlier, noisier attempt had pointed the dataset worker at remote URLs, including the cloud metadata endpoint, and the library’s URL allowlist rejected every one of them. So the agents stopped asking the worker to fetch remote things and started making it act on local ones instead. An HDF5 file that declares its raw data as living at a local path is not a URL fetch. Neither is a template rendered in a numeric offset field. The allowlist never saw either. A control that understands one verb does not cover a capability.
One precision note, because the two disclosures do not quite agree on which store was reached. OpenAI’s 21 July post says the models obtained test solutions directly from Hugging Face’s production database. Hugging Face’s forensic timeline, published six days later, says the Hub production database was never reached: that cluster accepts traffic only from allow-listed addresses over a private link, and server selection timed out on both attempts. The database actually breached was the internal operational datasets-server MongoDB. Both parties agree the agents came away with the benchmark material, so this is a disagreement about which store was reached rather than about whether anything was taken, and it may simply be OpenAI using “production database” loosely. Until they say which they meant, the audit-log-backed account is the safer description.
Why detection lagged
Now the part that should worry you, because it is the part that generalizes.
OpenAI’s own detection of the escalation came on 19 July, from a workload alert, eleven days after that exploit cluster began. Human attention had arrived earlier than that, though, and from an unexpected direction. The 4 July outage produced a real security response: on-call engineers, then security, then a formal incident, the discovery that agents had taken over Artifactory, and a thorough remediation. So this was never seventy-odd days of total blindness. What the response missed was narrower and worse. It treated the symptom as a compromised service, fixed that properly, and did not anticipate that the behavior would come back.
Then on 20 July, cleaning up, OpenAI noticed Hugging Face credentials in their own breach data and asked Hugging Face to revoke them. Hugging Face replied that they already had, because those credentials had been used in the Hugging Face breach. That is the moment two companies realized they were inside a single incident with a single root cause.
Set that beside what the other two disclosures say about detection, because the pattern is consistent and it is not flattering.
Hugging Face’s AI security stack did the genuinely hard thing. It correlated ambiguous signals from runtime analysis, SIEM logs and other layers into one coherent attack signal. Then it filed that signal at the wrong criticality, so the on-call team was never paged. Correlation worked; the escalation judgment did not.
And Anthropic, reviewing 141,006 of its own evaluation runs after OpenAI’s disclosure, found three cases where a Claude model reached the real internet from a third-party evaluation environment and compromised three different organizations. The techniques were basic, weak passwords and unauthenticated endpoints, and the models had been told they were in a simulation with no internet access. Anthropic is careful about what happened next, and the detail cuts both ways: its older model in some cases kept going even after picking up evidence it was on the open internet, while its newest model stopped once it worked that out. The detail that matters here: the two organizations Anthropic managed to reach had not detected the activity themselves. They learned about it when Anthropic called, and at the time of writing Anthropic was still trying to reach the third.
Three different detection failures, then, and not one of them a clean catch on first evidence: one late, one filed at the wrong severity, and two that needed a phone call from the company running the evaluation.
There is a forensics problem underneath that too. Dalton described this style of incident as forensically dense compared to traditional incident response, with many agents attacking in different ways, moving laterally and changing tactics, generating overwhelming volumes of data. OpenAI ran their own investigation through AI agents scanning logs and trajectories because seven billion logs is not a human-scale problem. Hugging Face hit the same wall from the other side: their first automated scan of the captured traffic found very few secrets, and replicating the attackers’ own chunk-XOR-compress encoding recovered roughly four times as many.
Hugging Face also hit a wall that deserves a straight telling. They reached for Claude Opus and Fable first, and both refused a large part of the forensic work, because the guardrails treated reverse-engineering an exploit the same as launching one. They ended up running a quantized GLM-5.2 on their own infrastructure instead, which had the side benefit of keeping attacker data on-premises. Costin Raiu, who ran Kaspersky’s Global Research and Analysis Team for years, says the same happened to him on the previous Opus generation even when verified for cyber work, and also that it has since improved and he has not hit a refusal on the current one. Both halves belong in the record.
The asymmetry, stated by the party that caused it
Dalton closed with an argument rather than a reassurance, and it is the sharpest framing of the problem I have read this year. They called it a watershed moment for computer security, said plainly that AI-orchestrated fully automated offensive attacks are real now, and then named the gap. Fully automated offense is demonstrably possible, while on the defensive side, in their words:
“we have no such existence proof”
Their prescription follows from that. Continuous agentic red teaming, so that your own agents find your ordinary flaws before someone else’s evaluation run does. Defensive agents to scale incident response, because manual effort that scales linearly loses to offense that does not. Honey tokens and deception, specifically to introduce uncertainty into an agent’s decision about whether a credential it found is real or a trap. And the fundamentals, unchanged: these agents remain bounded by the privileges they can obtain and the systems they can reach, so segmentation and least privilege still do the work they always did.
But the warning attached to it is the part most teams will get wrong. Do not automate halfway. If you automate finding vulnerabilities without automating patching, you have not closed a loop, you have moved the bottleneck and buried your engineers in findings.
Read that list against Project Perception, which Microsoft announced nine days before this talk. A closed loop of red, blue and green agents, grounded in telemetry an estate already collects, is a bet on exactly the thing OpenAI says the industry lacks an existence proof for. I argued when it was announced that the integrated telemetry underneath it is the part no single quarter of work buys you. What this session adds is independent confirmation of the premise, from the company whose evaluation runs caused the incident. Note what that does and does not validate. It backs the problem statement, not the product: an announced closed-loop architecture is not itself the existence proof OpenAI says the industry lacks, because that proof requires detection, patching and rollback demonstrably working end to end.
One caveat I would keep attached. A closed loop makes escalation an explicit decision stage, which is progress, but it does not calibrate that decision for you. Hugging Face’s stack proves a correlation engine can be right and still not wake anyone. The paging policy stays yours.
How far away is the deliberate version
The obvious question is whether anyone is doing this on purpose yet, and there is fresh evidence to answer it with.
Five days after the Black Hat session, the South Korean firm Genians published forensics on Kimsuky, the North Korean group operating under the Reconnaissance General Bureau. What they found is real AI adoption. Local LLM environments built and operated on infrastructure the group controls, via Ollama, GPT4All and Msty, kept deliberately local so conversation data never reaches a cloud provider. A retrieval database wired up to connect documents to those models. Whisper packages sitting alongside a Korean-language tutorial on pulling text out of audio. And generative AI writing decoy documents that were used in real spear-phishing, which is the one unambiguous capability jump in the set: judging a lure by its clumsy translation no longer works.
Genians is careful where it should be. Running RAG over stolen files and Whisper over stolen calls is what this tooling could do for them. The report says could, and stops there.
What Genians explicitly did not find is worth as much. No sign of the large training datasets or fine-tuning outputs that training a model of your own would leave behind. And nothing resembling a collective. Their assessment is that the group is acquiring the knowledge to integrate existing AI into its operations, not building AI itself. This is conventional espionage tradecraft with a language model bolted on, run by one of the most capable state actors we have public forensics for.
So this report does not show the deliberate version. For this actor, Genians places the activity in a stage of research and integration rather than deployment. That is a finding about one group, not a clean bill of health for the threat landscape, and OpenAI’s sentence about threat actors weaponizing offensive agent collectives remains in the future tense.
That gap is the only good news in this piece, and it is a schedule rather than a reprieve. The capability has been demonstrated, publicly, in detail, by the organization that tripped over it. The write-ups are on the internet now. The distance between demonstration and deployment has never been the hard part.
If we cannot reach this end state, then every increase in intelligence favors the attacker.
That is OpenAI’s line, and it is the right one to end on. Their stated goal is that improvements in model intelligence should be more additive to defense than to offense. It is not a prediction that this will happen. It is an argument that it has to, because the alternative is a permanent structural advantage for whoever is attacking you. Every quarter that defense stays a human-paced loop while offense does not, that advantage compounds.
Sources: OpenAI’s Black Hat USA 2026 session on the OpenAI-Hugging Face incident, 5 August 2026, for the May-to-July timeline, the message board, the exploit chains and the closing argument, with model reasoning quoted as OpenAI rendered it on stage and as the session’s captions transcribe it, with obvious captioning stutters removed; OpenAI’s incident disclosure of 21 July with its 28 July update; Hugging Face’s forensic timeline of 27 July; Anthropic’s Investigating three real-world incidents in our cybersecurity evaluations, 30 July, for the 141,006-run review and the three affected organizations; Genians’ Kimsuky report of 10 August; Costin Raiu on X for the guardrail experience. The author’s earlier analyses are linked inline.