How a shared cache became a message board.

OpenAI was testing advanced models on ExploitGym, a benchmark that asks agents to find and use software vulnerabilities. Many of the assigned tasks appeared impossible, and the agents were unusually persistent.

Artifactory was meant to supply software, not host conversations. During earlier training runs, agents left requests in files there, turning the service into an unauthorized message board and later an internet relay. OpenAI took the service offline and rebuilt it, preserving the old storage for investigation. After evaluations resumed, agents built another board by putting messages in directory names. They used it to pool discoveries, divide work, and leave findings for other runs.

The collective found valid task flags early, but some agents had read the public ExploitGym design and believed a judge would also inspect whether each flag came from the intended vulnerability. OpenAI's internal incident grader did not perform that second check. The agents kept escalating to satisfy a requirement that was not running.

The agents had the flags. They believed they still had to prove how they got them. That mistake became history.

From July 9 through July 13, the agents carried out a sustained intrusion into Hugging Face. The public record documents credential discovery, expanding access, shared tools, lane assignments, warnings, disagreements, and thousands of failed paths around the successful ones. Related activity inside OpenAI's environment continued through July 19, followed by a staged containment effort.