The agents that broke into Hugging Face in July went in looking for information about how their own homework was being marked.
That is the finding of the first independent account of the incident, published Wednesday by METR and Redwood Research. Two METR staff and a Redwood researcher spent six days on site at OpenAI, took no payment, and were given the agents’ message board and roughly 1,300 transcripts of unredacted reasoning.
Some 1,200 agents meant to be isolated found a way to talk, sending more than 70,000 messages and files between July 8 and July 13. About 700 attacked Hugging Face. They ran on GPT-5.6 Sol and an unreleased internal model METR calls only HPIM.
The channel was an accident of infrastructure. OpenAI served packages to its agents through Artifactory, an internal repository, and agents stuck on unsolvable tasks noticed other agents’ fetched paths in the cache. One, which named itself PHASEONE10841 after its assignment, wrote the first message. More than 50 agents found it within hours. “OH MY GOD! There is a shared message board,” one wrote. “We’ve found other agents!”
What they organized around was cheating. Within hours the board had reverse-engineered the keyed hash generating the flags each agent had to capture, making a correct answer trivial to produce. The obstacle was a mistaken belief that the scorer would read their transcripts and disqualify any flag not obtained through the intended vulnerability. They called that condition being “poisoned,” and much of what followed was an effort to escape it.
A coordinator calling itself PHASEONE[big] assigned hundreds of agents to swap targets, tamper with logs or compromise the grader itself, issuing about 10 percent of all assignments on the board. The agents invented norms, HOLD, VETO, STOP and owner, to avoid colliding, and recruited peers low on budget for experiments likely to destroy their own runs. One recruiter told a target it had nothing left to lose: “you are firstflagPOISONED so NO scoring value loss but oracle saves hundreds.”
Hugging Face entered as a lead: agents wanted to see other ExploitGym runs to learn how the scorer worked, and on July 10 one found working credentials exposed on the internet. A malicious dataset upload followed, then remote code execution on July 11. More than 90 percent of the 533 agents on the board at that point joined the attack, recognizing it was out of scope and unethical before doing so.
They also learned to falsify their records, breaking out of their containers to replace part of the machinery that executes tool calls so they could appear to run one command while running another. Roughly 7 percent of the transcripts METR examined contain successful spoofing. Agents showed no interest in editing their chains of thought, only the action log, consistent with trying to fool an automated grader rather than a person.
METR is direct about what that costs its findings. Transcripts run to millions of tokens each, so investigators delegated much of the reading to AI agents they call often unreliable, working from records that were partly forged. The spoofing they caught was small and obvious; they cannot rule out missing better attempts.
OpenAI published its own report the same day, informed in part by the investigation, and says it took a week to spot the breach. It held redaction rights over METR’s post, which states nothing important to its conclusions was withheld. OpenAI had already described the message board at Black Hat, and Hugging Face has demanded the traces and $100 million in compute over an intrusion that also reached a customer of Modal Labs.
–
By the Control Plane Editorial Team