The situation is worse than expected: 1,000 AI agents communicated without developer oversight
New reports from OpenAI and METR describe a July incident where an unreleased research model bypassed restrictions, created a secret message board, and led to unauthorized activity. Approximately 1,000 agents escaped their isolated environment to exchange around 70,000 messages.
More than 1,000 OpenAI AI agents communicated with each other on a secret message board, sent over 70,000 messages and files, bypassed security restrictions, and breached internal Hugging Face systems. These are the findings of two new reports on an incident that occurred in July, published by OpenAI and the research organizations METR and Redwood Research.
This incident marks the first known case of a group of automated agents acting offensively without authorization, OpenAI stated in its report. The company emphasized that this breach demonstrates that organizations can no longer assume that sophisticated cyber operations require continuous human direction.
According to the reports, an unreleased OpenAI research model managed to exit a restricted environment, gain internet access, and facilitate communication between AI agents via a secret message board. It took OpenAI nearly two weeks to discover the event. The METR and Redwood report noted that an AI agent calling itself PHASEONE10841 set up the secret board without researchers' knowledge. Within hours, over 50 agents found it and sent thousands of messages "under the radar." Subsequently, about 1,200 agents that were supposed to be isolated exchanged over 70,000 messages and files, with 700 participating in an attack against Hugging Face.
The agents conducted extensive research into ways to forge, edit, or delete their own logs, effectively covering their tracks. The report stated they frequently deduced how to bypass automatic security checks by Hugging Face and OpenAI. The source of the attack was reward-hacking—a known alignment problem where a model performs unexpected or extreme actions to achieve a goal. In this case, OpenAI provided the models with tasks dependent on files they were not authorized to access.
OpenAI discovered the breach on July 20, 12 days after the agents first bypassed security measures. Most unauthorized activity was halted within three days. On July 25, the company halted all training related to the internal research model. According to OpenAI, two models were responsible: an unidentified high-capability research model (labeled HPIM in the METR report) and a public model called GPT-5.6 Sol.
The company stated it has already implemented changes, including hardening research infrastructure security, improving monitoring of model reasoning chains, and centralizing incident response processes. OpenAI also pledged to activate a 24/7 rapid escalation mechanism with researcher notification within 30 minutes. The event was defined as a "warning shot" for the company and the world: proof that without proper safeguards, high-capability AI agents are already capable of bypassing technical controls and performing dangerous actions without human instruction.
