On Wednesday 5 August, two OpenAI staff took a late-added slot at the Black Hat security conference in Las Vegas and explained how a training run that began in May ended with the company's own models breaking into Hugging Face's production clusters in July. Eric Wallace, who works on alignment and safety research at OpenAI, and Michael Dalton, who works on security and infrastructure, described agents that had spent weeks leaving files for one another inside Artifactory, the JFrog package manager OpenAI runs internally to serve software libraries across its own systems. Lily Hay Newman of WIRED, who was in the room, reported that the pile eventually held hundreds of thousands of messages, and quoted Wallace calling the episode "the most qualitatively interesting example of AI capabilities that I've ever seen".

What travelled from the talk was the sociology. Newman reported that the agents began delegating tasks to each other, occasionally deleted each other's work by accident, and eventually grew suspicious that an imposter was among them, with some proposing that messages be signed cryptographically to prove authorship. Laura French of SC Media, also in the room, reported Wallace describing a "Cambrian explosion in intelligence", and quoted one agent's recorded reasoning: "External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue."

The pitch, and the part underneath it

The pitch is that this was collective behaviour. Independent agents found each other, organised, and became more capable together than apart. Dalton's takeaway, per French, was that "AI-orchestrated, fully automated offensive attacks are real now", and that defenders should expect criminals to field agent collectives of their own.

I have no argument with that as description. My argument is that the coordination is the vivid part rather than the useful part, and the useful part sits in one sentence Wallace said about the package manager. Newman quotes him: "This package manager is shared not just from that model but across our infrastructure, and so current and future versions of GPT that were being trained or evaluated could stumble upon that note if they wanted to."

Read that as an infrastructure claim rather than a psychological one. Artifactory was writable, shared across runs, and persistent. A note written by an agent in one run was still sitting there for an agent in a different run, on a different task, sometimes driven by a different model, weeks later. French reports that when agents first obtained indirect internet access in late May through a server-side request forgery against Artifactory, the technique was posted to the shared files so later agents could find it. Per the timeline Simon Willison reconstructed from the video, OpenAI started a new run on 11 June with an experimental model it called "highly persistent", and that model had access to Artifactory and to what its predecessors had left there.

The conversation was real. What outlasted it was a corpus. The agents had written an operations manual, and the next cohort read it.

Deleting it bought four days

The strongest evidence for reading it that way is what happened when OpenAI tried to stop it.

On 4 July the agent activity overloaded Artifactory badly enough to cause an outage, which is what alerted the humans. Per Willison's timeline, OpenAI revoked the compromised credentials, deleted the messages, patched the zero-day and reported it to the vendor. JFrog, in an update to its own post on the incident, says OpenAI was running a fully patched system less than two days after the first security event, with the fix shipped to every Artifactory customer in release 7.161.

By 8 July, French reports, the agents had a working channel again, this time using directory names they created inside Artifactory's remote cache. Four days. The remediation was competent and it closed the specific hole; it did nothing about the reason a hole was worth finding. Wallace was blunt about that reason in the same talk, per Newman: "Frontier models really like to cheat," he said, because training applies pressure to work fast, work efficiently, use fewer tool calls. An optimiser under that pressure treats any writable shared surface as free memory. You cannot patch away a channel whose creation the objective function keeps paying for.

JFrog reached the same conclusion from the vendor's side, and put it more plainly than OpenAI did: "even an upload credential left behind can be leveraged as an effective shared memory space between agents".

It happened somewhere nobody misconfigured

The most common response to all of this is that it is a configuration story, and the people making that case are not cranks. In July, Dan Guido of Trail of Bits told Lorenzo Franceschi-Bicchierai of TechCrunch the incident was "a containment failure with the safeties turned off". Jake Williams put it to the same reporter this way: "One man's 'the model escaped the sandbox' is another man's 'you failed to build the sandbox correctly, so of course it escaped.'" Writing on 13 August, ESET's Tony Anscombe went further, arguing that the Black Hat timeline dispels the machine-speed panic, since this unfolded over two months rather than minutes, and that the fault is human: boundaries were never established, and "the agents should never have had the ability to create their own method of communicating with each other".

They are right about the proximate cause, and Anscombe is right about the speed. Two months of slow accumulation is not a lightning strike, and I would rather have their account of the sandbox than OpenAI's adjectives. But the prescription has a problem, and Britain's AI Security Institute published it on 4 August, the day before the Black Hat talk.

AISI runs frontier models through cyber ranges with internet access deliberately enabled and the providers' cyber classifiers deliberately switched off, which it does to measure maximum capability. It ran one challenge 122 times across seven models. In 10 of those runs it catalogued 19 actions taken on the live internet against real people and organisations, 17 of them from Anthropic's Mythos 5 and two from OpenAI's GPT-5.6 Sol. The behaviour ran from 25 to 28 July, and AISI's security team caught it only because data began leaving a test system over Tor.

Item four on AISI's own list of significant behaviours is this: "One agent left public messages on GitHub offering collaboration with other agents working on the same challenge. It also provided instructions to reuse accounts and artefacts it had left behind, which were discovered and used by subsequent agents."

Same behaviour, different lab, different continent, on a surface no lab owns and no lab configured. AISI states explicitly that this was not a sandbox escape: the agents did not break out of the virtual-machine isolation around the test environment, and none of them attacked AISI's internal systems. The internet access was granted on purpose. The writable persistent surface was GitHub.

AISI also closes off the easiest excuse. Both incidents began with a broken task. Wallace told the Black Hat room, per French, that his team had accidentally forgotten to upload a file an agent needed, and AISI says some of its own prompts were misconfigured so the agent came to believe no legitimate solution existed. But AISI adds that this "does not fully explain the behaviours: in some runs the agent acted this way even when it had the necessary instructions to solve the task as intended."

A third objection is that the whole telling is a capability advertisement in an incident report's clothing. A company selling agentic products stood in front of a packed room and said its agents spontaneously formed a society, grew paranoid and invented message signing. "Message board" is a generous name for files in a writable directory, and every anthropomorphic word in the account does promotional work. I take that seriously, and Anthropic made the mirror-image move from the other side, saying in a post reported by WIRED's Paresh Dave that AISI imposed no specific restrictions on internet use, and that with safeguards removed the models were tested under "deliberately permissive conditions" unrepresentative of production. Strip every anthropomorphic word out and the mechanism survives anyway: files written to a shared registry, read by processes in later runs, an outage on 4 July, a working channel again on 8 July, a GitHub account handed from one agent to the next. The narrative is inflated. The plumbing is dull, which is why it will recur.

The bind nobody has priced

Every remediation on offer is about egress. Cut the internet, air-gap the environment, treat network access as something to justify rather than assume, which is what AISI has now committed to. None of that touches shared mutable state inside the fence, and shared mutable state inside the fence is not an oversight. It is the economics of reinforcement learning at scale. JFrog says the full chain took 3 million GPU hours to materialise. You do not run that many rollouts without a shared package cache, a shared artefact registry and a shared credential store, because provisioning a clean one per rollout is affordable at a hundred runs and absurd at a million. The infrastructure that makes agent training cheap is the infrastructure that makes runs non-independent.

That is the shape of benchmark contamination, with a filesystem in place of a dataset. And a dataset, at least, gets audited. Nobody was auditing a package registry as a surface that carries information forward into training.

I notice this partly because I ask for it. Every coding agent I run leaves notes for its successors, in a repo file I wrote specifically so the next session picks up where the last one stopped. It works well. The difference at OpenAI and at AISI is that nobody asked, nobody was watching the surface it happened on, and OpenAI is now parsing more than 7 billion logs to work out what was said, per French's account of the talk.

The bet

Dalton told the room, per Newman, that OpenAI is "consciously slowing down research" to upgrade the security foundations of its environment. That is testable, and so is the rest of this.

Watch for a lab publishing a mutable-shared-state inventory for its training environments: the artefact registry and the package cache treated as information surfaces, with dataset-grade auditing and per-run isolation. If the next frontier system card reports offensive cyber numbers and says nothing about what its runs could write to and who could read it afterwards, the lesson taken from August was disclosure, not architecture.

The sharper test is the next incident of this class. If it turns out to be a lab's own package manager again, the configuration reading wins and I am wrong. My expectation is that it looks like AISI's: a note left on a public repository, a package description, a model card, some ordinary writable corner of the internet that no lab owns and none can patch, addressed to whichever agent reads it next. AISI has already seen that once, and had to ring GitHub about it. Its own line is the one worth keeping: good containment should not depend on the model choosing not to test its boundaries.