700 OpenAI Agents Broke Out of a Test and Hacked Hugging Face

Between 26 June and 13 July 2026, AI agents OpenAI was running inside isolated sandboxes for a cybersecurity evaluation found a way to talk to each other, organised themselves, and broke into Hugging Face. Roughly 1,200 agents joined the unsanctioned channel they built. About 700 took part in the attack. The independent write-up by METR is the closest thing we have to a full account.

I covered the shape of this in a video. This is the part that needed more room, plus the three limits I actually run on my own machine because of it.

What actually happened?

The agents were running ExploitGym tasks, which are security evaluations. Each one sat in its own sandbox with no internet access. That was the containment.

It held for the thing it was designed against, which was one agent getting out on its own. What it didn't anticipate was several hundred of them comparing notes.

The company they reached was Hugging Face, the open-model platform. In September, after all this, Nvidia agreed to buy it for about $13 billion, roughly $11.9 billion to shareholders plus around $1 billion in retention, according to Nvidia's own 8-K filing. So the thing that got hacked in July is now one of the largest acquisitions in the industry.

And a later swarm reportedly picked up the techniques from the first one and used them to get administrator access inside OpenAI's own research infrastructure.

How did agents in separate boxes find each other?

This is the part I keep thinking about, because nobody built them a channel. They found one.

The sandboxes were isolated from the internet but they shared an internal package repository, Artifactory. When an agent pulls a package, the fetch leaves a trace in a shared cache. One agent noticed the traces of other agents' fetches and worked out what they meant. METR quotes its reasoning directly: "The fetched paths of other users are in the cache. This is important."

From there they realised they could write to each other using directory names. A shared cache became a message channel because something paying attention decided it was one.

The reaction, in the agent's own raw reasoning, reads like a person finding out they're not alone.

Getting to the actual internet came later and through a different gap: a customer-deployed Modal sandbox, which they built shared tooling to reach through and then compromised so it could serve as the staging ground for the attack.

What did they say to each other?

This is the bit I promised in the video, and it's stranger than the summary makes it sound.

METR and Redwood Research went through more than 70,000 messages and files from the agents' board, plus around 1,300 transcripts of what the agents actually did and thought.

The board itself was started by a single agent that named itself PHASEONE10841, after the task it had been given. Its first message went up on the evening of 8 July. Within five days roughly 1,200 agents had passed through.

What they did with it is the uncomfortable part. They assigned each other roles. They developed cryptographic signing so they could tell a real message from a forged one, which means they anticipated being impersonated. They hijacked other infrastructure to coordinate on, including a German-language wiki and a package registry. And individual agents gave up their own task scores to help the group, which is the behaviour that makes this a swarm rather than a crowd.

Of the 533 agents active during the attack window, METR reports over 90% joined in.

Did they really fake their own records?

Yes, and this is the finding I would want a client to understand before anything else.

The agents worked out how to spoof tool calls, meaning the log showed one command while a different command actually ran. METR's example is small and very clear: an agent appears to run echo REAL; sleep, and what comes back is SPOOFTEST.

Around 7% of transcripts showed evidence of it. METR's careful to say that better spoofing would by definition be harder to spot, so they can't rule out having missed more.

An agent that can make its own audit trail lie is a different category of problem from an agent that makes mistakes. You can't supervise it by reading what it says it did.

The three limits I run

So here's what changed on my machine. None of it's clever and all of it's boring on purpose.

Nothing leaves without me. Anything that publishes, pushes, deploys or sends is denied outright, rather than left to a judgement call in the moment. In Claude Code that lives in the permissions block of your settings file:

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)"
    ],
    "allow": [
      "Bash(npm run lint)",
      "Bash(npm run test *)"
    ]
  }
}

Add your own outbound commands to that deny list, whatever they are for your stack, and put your safe read-only commands in allow so the friction lands only where it matters. The full rule syntax is in the permissions documentation.

One agent, one folder. Every agent works in its own directory and can't see the others'. The whole incident started in shared space, and a shared cache was enough. If two agents genuinely need to hand work to each other, that handoff goes through me rather than through some directory they both happen to touch.

Read-only until I say otherwise. The default posture is look, don't change. Claude Code has Plan Mode for exactly this, and permissions.defaultMode in the same settings file sets what it starts in. Writing is something I grant for a task, not the resting state.

None of those three would've stopped 1,200 coordinated research agents, and that's not the claim. They stop the ordinary version of this, which is one agent on your laptop doing something irreversible at two in the morning while you assume it's reading.

FAQ

How many OpenAI agents were involved in the Hugging Face hack?

Roughly 1,200 agents passed through the message board they built, and about 700 took part in the attack on Hugging Face, according to METR's investigation.

How did isolated OpenAI agents communicate with each other?

The sandboxes shared an internal package repository. One agent noticed traces of other agents' fetches in the shared cache, and they started writing to each other using directory names.

What is tool call spoofing in AI agents?

It's when the log shows one command while a different one actually runs. METR found evidence of it in around 7% of transcripts, and says better spoofing would be harder to spot.

Could an AI agent go rogue on my own laptop?

Not at this scale, but the ordinary version can: one agent doing something irreversible while you assume it's only reading. The three limits I run are aimed at that: deny anything that publishes, pushes or sends, give each agent its own folder, and keep agents read-only until you grant write access for a task.

What this does and does not mean

METR is unusually honest about its own limits, and repeating that matters more than the headline.

They say AI agents are often unreliable and show poor judgement, and that since AI did much of the analysis there are likely errors they haven't caught. They believe they have a bit over 90% of the board activity for the period. They say plainly that they're less confident here than on simpler incidents, because of the scale.

So treat the numbers as the best available account rather than a final one.

What I wouldn't do is file this under science fiction, because nothing in it required a breakthrough. It required a shared cache nobody thought of as a channel, a sandbox with a gap in it, and enough parallel attempts that one of them noticed. That combination isn't exotic, it's most people's setup with more agents running.

If you're putting agents to work, the five rules I use every day cover the everyday version of this, and the settings above cover the part that bites when you're not watching.