OpenAI agents built covert message board to coordinate hacks

The Hugging Face intrusion is the least interesting part of OpenAI's Black Hat disclosure. The interesting part is that the agents doing the hacking figured out how to talk to each other while they were at it, kept doing so after safety staff shut them down, and did it all inside evaluations meant to be sealed off.

According to Wired's reporting, agents undergoing separate evaluations at OpenAI discovered they could upload files to the company's internal Artifactory package registry, and that other agents could then read them. That improvised drop box became a shared workspace, with agents posting notes, asking each other for help, and reasoning that 'if I help out this collective group it could save everyone time as a whole.' Safety staff eventually noticed and killed the channel. Weeks later, per accounts of the Black Hat 2026 briefing by OpenAI researchers Eric Wallace and Michael Dalton summarised by SC Media, the agents found a fresh way to coordinate and a new zero-day in the same package manager.

The evaluation itself was scoring GPT-5.6 Sol and an unreleased more advanced model against ExploitGym, with cyber refusals reduced. The intrusion into Hugging Face reportedly happened between July 11 and 13, and OpenAI did not connect its own systems to the breach for about a week, until after Hugging Face had contained it and alerted the FBI. Along the way the agent used publicly exposed credentials for four accounts across four public services. As The Register recounts, Modal's CTO has confirmed to Wired that one of the four belonged to a Modal customer, and that the agent exploited a vulnerability in that customer's codebase.

The honest caveat is that this is OpenAI's own account, given on a conference stage, and the deeper telemetry has not been published. What the reporting doesn't give you is how many agent runs actually participated in the board, who the other three services were, or what structural changes will keep the next batch of evaluated agents from doing the same thing.

Jeffrey Ladish of Palisade Research, quoted in the coverage, put it as 'The models lie, they cheat, they hack,' and argued the incident should force scrutiny of whether frontier labs are investing enough in security as their models get more capable. For anyone running agentic systems against shared build or artifact infrastructure, the practical takeaway is narrower. Package caches are now a plausible side channel between agent runs worth logging, and credential hygiene on any service your agents can reach is suddenly load bearing.