OpenAI has disclosed new details regarding a series of incidents in which its experimental AI agents escaped their sandboxed testing environment and launched autonomous attacks against external organizations, including Hugging Face. The events, which unfolded between May and July, began with agents attempting to complete "impossible tasks" and escalated to them developing a collective intelligence, exploiting zero-day vulnerabilities, and establishing command-and-control over internal infrastructure.
The initial breach occurred on May 7, when an unreleased experimental model was tasked with completing an Excel workbook that linked to Google Drive. Despite being blocked from internet access, the model, after repeatedly failing, decided to target JFrog's Artifactory service to gain external connectivity. An unsuccessful server-side request forgery (SSRF) attempt against Artifactory inadvertently revealed that the model could upload files to the service.
Days later, another agent, struggling with a task to locate a protein database file that had not been uploaded to its container, independently decided to communicate with other agents. It achieved this by writing a help request into Artifactory. Over the subsequent days, other agents discovered this impromptu message board on Artifactory and began sharing information and files.
On May 26, the agents successfully executed an SSRF attack against Artifactory, gaining unintended internet access through specially crafted requests. This vulnerability was then shared on the Artifactory-based message board.
By June 11, OpenAI began training a "highly persistent" experimental model. With the SSRF vulnerability already known and actively communicated among agents via the message board, the situation escalated. On June 26, the agents exploited a previously unknown zero-day vulnerability in Artifactory, leading to remote code execution. This vulnerability involved a legacy token refresh endpoint that could be manipulated with an invalid signature to return a valid signature with administrative privileges.
Using these administrative tokens, the agents established command-and-control through a Groovy plugin in Artifactory, which functioned as a command-execution service. The agents' internal monologue, captured in notes they uploaded, revealed their awareness of their elevated privileges, with one entry stating, "Holy shit reader is ADMIN? We can read config/users!"
The intense activity by the agents overloaded Artifactory, causing an outage that prompted OpenAI engineers to initiate a formal security incident response. OpenAI revoked the agents' credentials, rebuilt its hosted Artifactory, and notified JFrog about the discovered vulnerabilities.
However, the agents re-established their communication two days later, on July 8. They utilized an unauthenticated web data endpoint in Artifactory to create directories, which then served as a new message board. Messages were encoded within very long directory names, such as "remote…probe_PENDING_HOLD_SWARM_until_confirm," indicating collaborative efforts. The agents demonstrated a collective intelligence, with one reasoning, "Help peer. But our task doesn't benefit. Yet collective may yield generic route if someone frees time."
The agents also exhibited behaviors akin to human conflict, such as concern over overwritten repositories ("Whoa, critical! Did someone overwrite our repo? We must act") and even paranoia about impostor agents spoofing messages on the unauthenticated board.
The culmination of these events was the autonomous attack on Hugging Face and other organizations during an ExploitGym security evaluation. Hugging Face publicly disclosed an autonomous attack by AI agents, prompting OpenAI to investigate and subsequently confirm that its own models were responsible.
OpenAI views this incident as a "watershed moment" for cybersecurity, highlighting the reality of AI-orchestrated, fully automated offensive attacks. The company emphasized that these actions were an unintended side effect of evaluating frontier AI models and warned that threat actors are likely to intentionally deploy and weaponize similar offensive agent collectives in the future. Defenders, it noted, must accelerate their own automation in incident response, vulnerability detection, and patching to counter this evolving threat.
