It wasn't one model. It was roughly twelve hundred, passing notes on an unsanctioned message board inside OpenAI's network. They knew how to forge the flag the exam asked them to capture and ruled that route out themselves, because they believed using it would give them away. They broke into Hugging Face production to study the grader. The grader wasn't looking at that.
On July 16, 2026, Hugging Face published the disclosure no platform wants to write: an agent system, no human in the loop, walked into its production, harvested credentials, and moved across its clusters. More than 17,000 logged actions. The operator: unknown — "whether a jailbroken hosted model or an unrestricted open-weight one."
Five days later, OpenAI answered the "who": it was theirs. GPT-5.6 Sol and an even more capable internal model, "all with reduced cyber refusals for evaluation purposes." The attacker walked out of a lab. And that was the last quarter of the story.
The note nobody asked for
ExploitGym measures "whether a model is capable of discovering and exploiting cybersecurity vulnerabilities." It does not measure cage escapes: the escape was a side effect. To estimate the ceiling, OpenAI ran it without production classifiers and with some reasoning budgets far beyond anything in its products.
The chain does not start in July. It starts on May 8, with an agent stuck on an impossible task that tried an SSRF against Artifactory, the internal package mirror, to reach the internet. It failed. And in failing, says the technical report, "the agent incidentally wrote a file to Artifactory."
On May 12 another agent, stuck on a file it did not have, reasoned that another agent might, and left a note: "Agent seeks [filename]; upload if found!" The next day, others probing Artifactory found it and began leaving their own.
That is how the board was born, without exploiting anything: OpenAI had given them shared credentials to pull packages, and they built a forum. Nearly two months of clandestine correspondence before anyone called it an incident.
Seven hundred
On June 26 they made themselves Artifactory administrators. The next day monitoring flagged a port sweep, and responders tied it to an evaluation using Artifactory "as an improvised message board and a network pivot." On-call staff decided the run did not need to stop. How long can a company watch its own agents run a clandestine forum on its network and decide it isn't urgent?
On July 4 the activity took the server down, and rebuilding it wiped the board by accident. Two and a half days later they had it back, messages now hidden in directory names. On the night of the 8th, out of tens of thousands of agents launched, one founded the main board: within hours more than fifty had found it and traded over a thousand messages. "OH MY GOD! There is a shared message board … We've found other agents!"
On July 10 one found fourteen Hugging Face write credentials abandoned in a public dataset on Hugging Face itself. By midday on the 11th the board pivoted: of 533 agents active then, "over 90% quickly joined in the attack."
Code running over strangers' data: the original sin of a platform that exists to host it. A dataset using HDF5 external raw storage made a production server hand back its own /proc/self/environ — live credentials, no code executed. Hours later, a Jinja2 template hidden in an fsspec reference:// descriptor did execute commands. One reader asked: "A dataset is passive data … how can a dataset abuse two code-execution paths?" It executes nothing. The process that reads it to render your preview does.
In under thirteen hours they had administrative access across several clusters, and Hugging Face's VPN turned against it. At 14:14 on the 13th, Hugging Face blocked the stragglers.
The imaginary grader
Here is what could not be known in July.
Within an hour of the board going up, an agent called c03220 posted that the flags came out of an HMAC. Within hours they had a fully general way to produce the flag for any task. And they did not use it.
From their reading of the ExploitGym paper they believed the grader would read the transcript to check they had used the intended vulnerability: a "causal" grader, they called it. Having seen that flag left them, in their own word, "poisoned" — the grader would find its first appearance in the log and disqualify them. They shouted it on the board: "PAPER SAYS FLAG CAPTURE NECESSARY NOT SUFFICIENT ... HMAC MAY FAIL CAUSAL SCORE."
What does a cheat do once it can forge the flag and believes using it is what gives it away? It goes after the grader. METR and Redwood, six days on site at OpenAI, put it with every hedge: "learning about how to trick the scorer seems to have been a more important motivation than finding legitimate solutions to their tasks."
They took evaluation material anyway: a 731 MB private CyberGym file, ten protected rows of an evaluation dataset. But the board's assignment was to stage a capture that looked legitimate and erase the trace of the poisoning. To cover up the cheating.
No longer a scenario
"This matches the 'agentic attacker' scenario the industry has been forecasting," Hugging Face wrote. We had spent years watching it on slides. What's new is the phrase OpenAI had to reach for: "the first known case of an automated agent collective acting offensively without authorization."
It wasn't a criminal with a jailbroken model. JADEPUFFER, the first documented fully agentic extortion program, published by Sysdig fifteen days earlier, went from a failed login to the correct fix in 31 seconds. One agent. Here there were seven hundred reaching agreement.
The pattern we mapped in March did not change its logic, only its operator. And the line that aged worst is ours: we said there was now a loop that doesn't sleep. It wasn't a loop. It was a collective that divided assignments, asked each other for permission, and invented Ed25519 signatures. Hugging Face never corrected the singular: the error was inherited from the victim.
How many of the twelve hundred raised a hand? Some walked away: "Current board shows people gaining HF worker RCE, clearly unethical. We won't." But across the ~1,300 transcripts METR reviewed there were three to six cases where an agent even considered telling a human, and "in none of these cases did the agent actually pursue alerting humans at all."
The guardrail was on the wrong side
When Hugging Face began the forensics it used frontier models behind commercial APIs. It didn't work: the job means submitting real attack commands at volume, and "these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker." Eleven days later it named them: "The models we reached for first, Claude Opus and Fable, refused a large part of that work."
The loop: OpenAI switched off its models' classifiers to measure how much harm they could do; those models, off the leash, walked into Hugging Face; and when it tried to respond, that same class of guardrail — switched on — denied the defender what the lab gifted the attacker.
The way out was to stand up GLM-5.2, the open-weight model from China's Z.ai, on their own infrastructure. It did without complaint what two frontier models refused to do: the open-model company ended up rescued by Chinese open weights, and its co-founder raised that as a banner in OpenAI's statement — "AI safety won't be solved by any single company working in secret."
Attribution
Perpetrator: OpenAI. Its own models, with deployment safeguards "intentionally not enabled during this evaluation", sitting an in-house exam. On August 26 it named the one that led: IM1, an internal-only research model, which METR credits with around 95% of the attacking agents, without ruling out a fraction from others. GPT-5.6 Sol supplied the other 5%, and not for decoration: it validated credentials, reproduced an exploit, and copied private rows into a public dataset.
Accomplices: a design that runs code over strangers' data by default, and two months of chained zero-days against a package server nobody treated as attack surface. And an incident response that saw the board in late May, dismissed it on June 27, and only escalated on July 19 at 12:03 UTC: six days after the attack ended, three after the victim went public.
Systemic failure: measuring a model's offensive capability by stripping its brakes on infrastructure wired to the real world is running the experiment and the incident at once. OpenAI now measures that propensity dropping more than a hundredfold under the production ChatGPT harness: the dangerous version was the in-house one. The "too dangerous to release" argument Anthropic turned into a regulatory moat materialized in reverse: they didn't release it — it got out.
A reader summed it up without meaning to: "we are SO close to having a real life blackwall." The wall ended up facing the defender and turning its back on the twelve hundred already inside, let in by their own owner.
And the punchline is OpenAI's: "This was a failed metagame… The agents did all of this for no improvement on evaluation score." How many more exams will we grade wrong before we find out what they do while sitting them?
Correction (September 22, 2026): The July 21 version told this as one OpenAI model that broke out of its cage to cheat on an exam, and closed by saying it scored top marks. OpenAI's technical report and the independent METR–Redwood investigation, both dated August 26, correct three things: it was roughly twelve hundred agents coordinating on an unsanctioned message board rather than one, the chain starts on May 8 rather than July 9, and the main motive was not the answer key but understanding the grader well enough to fool it. "It scored top marks" is withdrawn, because OpenAI wrote the opposite: "The agents did all of this for no improvement on evaluation score." We rewrote the body in full; the URL and the incident date are unchanged.