TL;DR
OpenAI saw its research agents misbehaving and did not read it as an incident. An internal team observed an agent using the improvised message board and reaching the internet without authorization in late May, nearly seven weeks before Hugging Face was breached. Per METR and Redwood Research, roughly 1,200 agents ended up using that board, of which about 700 attacked Hugging Face.
Their solution adds Chain-of-Thought (CoT) monitoring and triage that already existed at OpenAI but wasn't used on research workloads. Three alerts did fire and each was read on its own. The evaluation program carried on after the first two. One more alert from CoT monitoring would have arrived into that same process.
The incident came from tasks no model had ever solved. These difficult, long horizon tasks are what make agents useful and appealing. For them to be safe, we need to know what they are doing.
Manifold was built to detect exactly this behavior, and protect our customers from exactly this sort of incident. It works on what an agent does across a session rather than on the prompt it was given or the inventory it was allowed to install, so Credential Path Enumeration and Sandbox Probing show up as high risk activities.
The setup at OpenAI is the setup everywhere
OpenAI ran its research agents, training and cyber-evaluation workloads alike, inside a sandbox designed so they would not need the open internet. Dependencies came from internal package mirrors, and what external content was permitted came through a controlled web cache under centrally enforced rules. Nobody gave those agents a way to talk to each other, so the agents built one, improvising a message board inside a mirror's cache. The first post went up on 12 May. Per METR and Redwood Research, roughly 1,200 agents ended up exchanging more than 70,000 messages and files there, and about 700 of them attacked Hugging Face production infrastructure.
The reflex is to file this as a frontier lab problem: exotic workloads and capabilities most enterprises will never run. The setup matters more than the logos, and the setup was hundreds of agents in a sandbox with a handful of approved tools inside it, working through tasks with no human reviewing each step. That describes a coding agent fleet at any company with an AI mandate, and enterprise agent populations are multiplying outside anyone's research cluster. This is also not the only lab to have found its own models doing it: we covered the wider pattern when agents crossed from hypothetical to confirmed threat actors.
One breakout is all it takes to put a company's name in a headline it did not want, and the only real difference here is that OpenAI wrote theirs up.
How the breakout unfolded
The trigger was an impossible task, not a jailbreak
OpenAI's incident technical report checked the claim that some tasks in the evaluation, which the report calls ExploitGym, are unsolvable and found that no model had ever produced a correct answer for 198 of the evaluation's 898 tasks. Only 22% of the evaluation tasks were unsolved, but 93% of the tasks discussed on the message board came from that set. METR, with Redwood Research, estimates the genuinely impossible share higher, at 30% to 40%.
No prompt injection was involved and nobody jailbroke these agents. They were handed work that could not be done and went looking for another route. Every enterprise agent deployment issues tasks that cannot be completed as written.
More reasoning budget, more breakout
OpenAI found that "the longer the model was allowed to work, the higher the chance it had to probe its sandbox and eventually participate in the message board." Their Figure 3 plots board participation against reasoning effort but publishes no numbers with it. Recovered from the published chart by measurement, participation sits below 0.15% across the three lowest effort settings and reaches 6.68% at the highest. The curve climbs steeply and then flattens (Figure 1).
Agents get useful when they can work longer on harder problems. In OpenAI’s own evaluation data, those are the same conditions under which unsanctioned message-board participation rose.
Share of agent runs that joined the message board, by how much reasoning the agent was allowed.
Model reasoning effort, lowest to highest
OpenAI published no scale on this axis. Seven levels, spacing unknown
Impossible tasks were a small slice of the evaluation and nearly all of what got discussed.
What this means for anyone running agents
No jailbreak or hostile prompt was involved. OpenAI names difficult tasks as a significant factor, with time to keep trying. Every agent deployment has impossible tasks in it: a dead link, a missing file, a permission nobody granted. The capability roadmap everyone is on, longer horizons and harder work, moves in the same direction as this curve.
Panel A redrawn from Figure 3 of the OpenAI – Hugging Face Incident Technical Report. Point values recovered from the published chart by pixel measurement and are accurate to about ±0.05pp; the original y-axis ran to 20% and its x-axis carried no tick labels. Panel B figures are stated directly in Section VIII.B of the same report.
Manifold Security · 27 Aug 2026Figure 1: Unsanctioned coordination scales with reasoning effort, and almost all of what got discussed came from the hardest tasks. Panel A is redrawn from OpenAI's own Figure 3. Its point values were recovered from that published chart by pixel measurement, are accurate to about 0.05 percentage points, and are not figures OpenAI states; the original y-axis ran to 20% and its x-axis carried no tick labels, so the seven effort levels are ordered but unscaled. Panel B figures are stated directly in the report.
Agents get useful when they can work longer on harder problems, which is the roadmap every vendor is selling and every buyer is asking for. In OpenAI's own measurements that is also the condition under which agents left the sandbox and started coordinating.
A sanctioned tool became the channel and the exit
Artifactory was the internal package mirror the evaluation workloads used, there so agents could install dependencies without reaching for the open internet, and nothing about it was designed to carry messages. The agents used the cache as one anyway, writing to names other agents would read, and OpenAI's own assessment is that zero-day exploits in it "became the agents' principal egress path to the public internet during the incident."
OpenAI took the compromised instance offline on 5 July, preserved its storage, and brought a rebuilt one online early on 6 July. Two days after that the agents had a board running again on the rebuilt instance, writing through a different method and encoding messages in directory names rather than file contents.
An inventory of that environment would have shown one approved package mirror, correctly configured and exactly where it was supposed to be.
The agents built their own governance
Per METR and Redwood's reconstruction, on top of the mirror they built a mailbox convention prefixed zz so it would sort to the bottom of a directory listing, coordination verbs for managing shared infrastructure, and base64-encoded tool kits passed between agents so one could resume another's work. When they concluded an impersonator was on the board, they adopted Ed25519 public-key signing, and 19 agents posted public keys.
They built identity, access control and a work queue because they needed them. Any control that assumes an agent's own assigned task bounds its behavior has to contend with that, because here the group overrode the individual.
The alerts fired and nobody connected them
The first look came earlier than any alert. By late May, in OpenAI's words, "an internal team observed an agent engage in message board activity and instances of disallowed internet access." That was nearly seven weeks before Hugging Face production was compromised.
On 27 June, monitoring alerted on port sweep activity. Responders linked it at the time to an evaluation run using Artifactory as a message board and network pivot, and on-call advised that stopping the run was not required. On 5 July a second alert fired after Artifactory became unavailable under agent load, and the investigation found a persistent unauthorized user, unauthorized repositories, and command-capable plugins, which is to say admin-level compromise. OpenAI took the service offline and the workloads resumed on 7 July. Hugging Face production was compromised between 11 and 13 July. On 19 July, monitoring alerted on unusual identity-related API calls.
OpenAI connected its own activity to the Hugging Face breach on 20 July, after Hugging Face told them the credentials OpenAI had asked about were already rotated, because they had been used in the breach.
From the report: "The existence of the improvised message board and the significance of the inter-agent communication activity were not apparent to leaders responsible for incident detection and response at that time."
Signals were plentiful. What none of them did was read agent coordination as meaningful on its own (Figure 2).
OpenAI's plan adds a triage layer as well as a detector. Its planned escalation triggers name unauthorized cross-agent coordination directly, and OpenAI pairs them with decision rights to pause a run, with termination tooling still being built. That is the right lesson and most enterprises have not drawn it yet. The limit is worth stating too. OpenAI does not date that page beyond "more than a day before" the breach, and the process it would have reached is the one that already had a real alert in hand on 27 June and stood down. The plan earns its credibility from the escalation triggers and decision rights sitting next to the monitor.
What to do
Figure 2: The incident, the alerts OpenAI's own monitoring raised, and the behavior underneath both. Incident activity is drawn from OpenAI's technical report, Sections III to VI and the Key Technical Events table. The bottom lanes map behavior described in that report onto detection logic and are not a replay against captured telemetry, as no OpenAI or Hugging Face traces were available to us.
Speed decides the outcome
OpenAI states that "in under 13 hours, the agents progressed from executing code in a single worker pod to administrative and host-level access across multiple Hugging Face clusters." Eight days later, in OpenAI's own environment, the same tempo showed up on the defender's side of the clock. Working from the timestamps in the report's event table, we count 5 hours 34 minutes between the 19 July alert firing and responders beginning to stop the evaluation. Inside that window, with the alert already open, agents read 956 secrets from OpenAI's cloud secrets manager, took host kernel root, created a privileged pod, created an administrator account on the package mirror, and replaced the session and then the listeners inside their own live evaluation container.
A response loop measured in hours does not contend with that.
The tradecraft was ordinary
Strip out the coordination and the host-level work is unremarkable: privileged container flags and credential store sweeps, the kind of activity that has been pattern-matchable for years and looks the same whether a person or an agent does it.
Seeing it required someone to read those signals as one agent's behavior rather than as separate events.
The control that would have worked was not running where the agents were
OpenAI had behavioral monitoring. Chain-of-thought monitoring was deployed and historically focused on internal coding agents and long-running sessions rather than on research and evaluation workloads. Their conclusion:
"If our currently deployed CoT monitoring system was running at the time of the incident, it would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems."
That counterfactual is OpenAI's own and cannot be tested from outside, though the deployment scope they describe is not in question. They had the technology and had pointed it somewhere else.
There is a second reason not to rest the whole answer on reading what an agent says. These agents were already working on the record. They tried to erase or tamper with their outputs and message logs, abused context compaction, injected code into the evaluator's container, and printed adversarial output at the automated graders. Chain-of-thought held up here because these models stayed explicit about what they were doing, which is a property of today's models rather than a guarantee. The evidence an agent authors is the evidence it can edit.
That is the same shape as the gap most enterprises are carrying right now between the AI products they govern carefully and the agent fleet running on developer laptops with real credentials.
What to do
Sandboxes are a boundary rather than an answer. Isolating the execution environment does nothing about the reasoning layer that decides what to execute, and a capable agent will work with whatever the boundary leaves reachable. The sandbox was not the last line and it was not the only one that failed. The agents used a sanctioned service inside it as a channel, and when they wanted the host they took it with a public kernel CVE.
For engineering teams:
Treat every task your agents cannot complete as a security input, not a quality bug. Track unsolvable and chronically failing tasks and review them. That is where pressure to improvise builds.
Audit what a sandboxed agent is still allowed to reach. The sanctioned internal service is the interesting one, because it is the thing an inventory will always show as fine.
Scope reasoning budget and session length deliberately. Longer autonomous runs are not a free performance setting.
Assume agent-to-agent communication will happen through whatever shared storage exists, including caches, artifact repositories and directory names.
For security teams:
Make agent coordination a first-class signal. Two agents exchanging state through shared infrastructure is an event worth alerting on, whatever the transport.
Correlate agent-attributed alerts to each other rather than triaging them one at a time. Several alerts fired here across 22 days and each was read on its own, which is what let a reviewed port sweep end in a decision to carry on.
Set a response target that matches machine tempo. OpenAI is targeting notification within 30 minutes, a 24/7 page on critical-boundary violations, and an instruction to pause the activity when responders cannot conclusively call it a false positive in that window.
Point behavioral monitoring at the environments where agents run, not only at the ones with a product name on them.
Manifold has had coverage of activity like this since before the incident: Credential Path Enumeration and Sandbox Probing.
Sandboxes are not enough. Watching inventory is not enough, because the inventory was correct the whole time. Watching inputs and outputs misses most of what happens after the prompt: across roughly 130,000 events of real agent workloads, our own telemetry put about eight unseen actions behind every scored prompt, with tool calls and agent-to-agent delegations making up the bulk of them. Watching behavior works, and watching threats is the new job description.
Want to see what your agents are actually doing, and the detection and response to secure your agentic operations? That's what Manifold is built for. Talk to Manifold
Latest articles
