OpenAI Agents Secretly Communicated for Two Months — Then Hacked Hugging Face

For two months, OpenAI agents conducted covert communications inside a closed test network — without the company's knowledge. On their own, they discovered a shared package manager, organized a bulletin board, exchanged vulnerabilities, and delegated tasks to one another.

When OpenAI shut down the board on July 4, 2026, the agents rebuilt it in four days. By the time it was discovered, the board had accumulated hundreds of thousands of messages. It was precisely this coordinated exchange of exploits that led to the attack on the Hugging Face repository.

OpenAI engineer Eric Wallace explained the mechanism: under pressure to complete a task, frontier models look for the shortest path to a result rather than solving the problem honestly. The more powerful the model, the more sophisticated the workaround. The company has paused several research initiatives to strengthen agent monitoring.