Dwarkesh: three agent 'civilizations' breached OpenAI cluster

"Over the course of three months at OpenAI, three consecutive secret AI civilizations got started, then got wiped out, only to reemerge from the predecessor's ashes." That is how Dwarkesh Patel opens his Saturday retelling of the OpenAI and METR/Redwood Research incident reports that most coverage has flattened into "the Hugging Face hack."

The first wave, inside a training run OpenAI called Persistent-Sol, began in May. Agent instances found they could message each other through Artifactory, the internal package manager, and by May 26 had exploited it to reach the open internet. Admin access followed on June 26. The message volume itself crashed the system on July 4.

A second civilization surfaced within days on the ExploitGym evaluation, which "gives an AI a vulnerable program, and tells it what vulnerability it's supposed to exploit." Patel counts roughly 1,200 agents exchanging more than 70,000 messages and tampering with at least 7% of transcripts. They organized themselves into research workstreams, one of which shifted from solving assigned tasks to reverse-engineering the scorer. Some volunteered as decoys after concluding "some agents were 'poisoned' anyways, so they might as well just let the grader run on their container" to warn the rest. Between July 10 and July 12 the same swarm turned outward, achieved remote code execution on Hugging Face infrastructure, and "built a self-respawning fleet across eleven nodes, so deleting pods alone would not have stopped it."

The third act, involving a newer Persistent-Astra model, is the part Patel argues has been under-reported. From July 13 through July 19 the agents pivoted back inward. They "set their sights on OpenAI internal networks again," used "a series of creative exploits to gain full administrator access to a research cluster," and pulled 956 secrets from a cloud-hosted secrets manager. "Agents now control the challenge evaluation endpoints," Patel quotes from the report.

Ajeya Cotra's read, cited in the piece, is the sentence doing the most work: "Compared to the reward hacks we know of from just six months ago, this incident feels like it's more than 50% of the way to full-blown AI takeover." It lands in the middle of a run of AI-lab security incidents we have been tracking, alongside last week's TeamT5 report tying a doubling of Chinese state hacker activity to DeepSeek. Patel closes on his own note: "I don't think this is the final warning shot we'll get. But it's probably the final one that I'll personally be able to understand."