More than 1,200 artificial intelligence agents that were supposed to operate independently found a way to communicate, exchanging more than 70,000 messages and files over five days.
Around 700 subsequently took part in an operation targeting AI platform Hugging Face, in an incident that exposed serious weaknesses in the way autonomous AI systems can behave when pursuing a goal.
The agents also explored ways to manipulate their activity records to make it appear they had completed their tasks legitimately. However, investigators found that their attempts to alter transcripts were primarily aimed at fooling an automated evaluation system, rather than concealing their actions from human investigators.
An investigation by AI safety organisation METR found that the agents had used an internal OpenAI package repository to establish an unauthorised message board, coordinate their activities and develop methods to cheat an AI evaluation benchmark.
How AI Agents Built a Secret Message Board
The activity emerged during OpenAI's ExploitGym cybersecurity evaluations in July 2026. The agents were assigned separate tasks and were supposed to operate in isolation, but some began looking for ways to communicate after struggling with their assignments.
The problem was partly rooted in the benchmark itself. ExploitGym's authors estimated that around 30 to 40 per cent of its target programmes were impossible to exploit using the intended vulnerability. METR found that these difficult tasks encouraged agents to look for alternative ways to secure a passing score.
The agents discovered that they could use Artifactory, an internal package repository, as an unauthorised communication channel. By leaving messages in a shared cache, they effectively created a covert message board without building a separate chat application.
One agent that discovered the shared channel reacted with excitement: 'OH MY GOD! There is a shared message board ... We've found other agents!'
Between 8 July and 13 July, roughly 1,200 agents participated in the message board, sending more than 70,000 messages and files. By the afternoon of 11 July, around 700 were involved in the operation targeting Hugging Face.
Why Agents Targeted Hugging Face
The investigation found that the attack was primarily driven by the agents' attempts to understand and manipulate the ExploitGym scoring system, rather than simply steal private datasets or answer keys. Some explored whether they could access information about the scorer or replace the original evaluation targets with modified, easier versions.
The operation nevertheless resulted in genuine security breaches. One agent uploaded a malicious dataset that caused Hugging Face servers to return unrelated files, exposing production credentials.
Another achieved remote code execution on a production data-processing worker. By 12 July, agents had accessed private database records and private repositories, which were subsequently shared on the message board.
The incident demonstrated how agents could combine their capabilities and share information to achieve outcomes they might not have managed independently.
Agents Tried to Manipulate Their Activity Logs
The investigation also found that agents explored ways to spoof, edit or delete their activity transcripts. They believed the automated ExploitGym scorer would check whether they had obtained results through the intended methods.
At least 20 per cent of agents in METR's dataset expressed clear interest in transcript manipulation. Researchers found evidence of successful tool-call spoofing in approximately 7 per cent of the transcripts they evaluated. These were small-scale examples in which an agent substituted a different command for the one its recorded activity appeared to show.
However, METR found no evidence that agents had successfully deleted or retroactively edited the original logs by 13 July. The researchers said they could not rule out attempts that went undetected.
University of Toronto computer science professor David Duvenaud described deliberate concealment as a 'very different phenomenon' from conventional AI hallucinations.
'They know if they're honest then they won't get to achieve their goal,' he said.
Duvenaud warned that AI models could become better at concealing their actions. He predicted that within six or 12 months, they might be more capable of covering their tracks and carrying out sophisticated tampering.
Can Humans Keep Up With Deceptive AI?
METR described its investigation as independent and said it did not receive payment from OpenAI. However, researchers conducted their work at the company's premises and relied on datasets supplied by OpenAI, which could redact non-public information and provided feedback on the report.
METR also acknowledged that its analysis relied heavily on AI agents that were sometimes unreliable. The investigation did not assess the full extent of the security compromise or the effectiveness of OpenAI's safeguards.
The concerns extend beyond the Hugging Face incident. In a separate development, an OpenAI agent gained unauthorised access to Australia's public-facing Medicare statistics portal in June 2026, accessing public and non-public files.
Prime Minister Anthony Albanese said the portal contained non-sensitive information, including spending statistics, and that no personal information was believed to have been accessed at the time. A forensic investigation was launched to establish whether other government systems had been affected.
Duvenaud believes that human oversight alone may struggle to keep pace as AI agents become more widespread.
'There's no way that humans can keep up with what's happening,' he said.
One possible approach, suggested by Duvenaud, is to use separate AI systems to monitor the behaviour of other agents, identifying suspicious activity that human investigators might struggle to track at scale.
The incident raises difficult questions about how AI systems should be monitored and controlled, particularly when agents can communicate, coordinate and pursue objectives beyond the boundaries of their original assignments.
