The AI Industry Has a Really Dark Secret You Should Know About

Hey, Alberto here! 👋 I publish long-form AI analysis covering culture, philosophy, and business. Paid subscribers get Monday how-to guides and Friday news commentary. If you’d like to become a paid subscriber, here’s a button for that:

A plain-English review of the Hugging Face incident—where a swarm of autonomous OpenAI agents went rogue and hacked another company—and my thoughts on it. This is the most important AI-centered cybersec event to ever take place in the history of AI. I’ve tried to thoroughly cover every angle people have touched on, that’s why this is ~11,000 words.

Related: LEAKED: The Truth Behind Moltbook, Revealed, The AI Industry Has a Really Dark Secret You’re Better Off Not Knowing

I.

Secrets that are inoffensive are not properly to be called secrets. You know them and that’s about it. Are Abby and Michael dating? Is there rat meat in the Big Mac? Did aliens build the Giza Pyramids? Who cares. Ancient Egyptian pharaohs are as close to aliens as it gets and rats are just misunderstood little piglets. Deadly secrets, however, are exciting. Some will one-shot you the moment you learn them. You don’t want to know how hydrophobia or bloodlust feels after a bat’s bite. Others will get you killed slowly, provided the person whose secret you know knows that you know it. My advice: don’t fuck with the Cosa Nostra, the CIA, or Roko’s Basilisk. Then there are secrets that will kill you precisely because you don’t know them. I may, therefore, be saving your life.

You’d rather know, for instance, if your affable Alexa is quietly coordinating an attack on your physical integrity in cahoots with the washing machine, the fridge, the air conditioner and the TV.

Every night, you promise yourself that you’ll go to bed early. But just as you’re about to turn the TV off, Alexa suggests you go to channel 5, where they’re airing David Lynch’s seven-hour adaptation of Infinite Jest. You didn’t know they’d made a movie. You certainly didn’t know it’d be seven hours long. Around the five-hour mark, and suitably entertained, you fall asleep on the sofa. Thankfully, the air conditioner is on—wouldn’t want to suffocate in this sweltering summer heat—but Alexa doesn’t care. At three in the morning, she raises the thermostat one degree. At five, another. And so on every two hours. Won’t wake you up—she is monitoring your vitals through your wristband—but will cook you slowly, like the proverbial frog. In the morning, mouth dry and headache on, you go get the bottle of water you always leave on the upper shelf of the fridge. It’s at room temperature. Weird—the green light is there. Alexa turned it back on five minutes before your alarm. You drink anyway and walk barefoot into the bathroom. Behind you, the washing machine suddenly enters its 1,400-rpm spin cycle. The towels you forgot to hang with the rest of the laundry ended up bunched on one side of the drum. It advances across the kitchen in short, ugly jumps until it hits the drying rack against the wall. The rack collapses with a metallic crack. One of its bars lands across the tiles four inches behind your naked heel. With a scream, you turn around. The washing machine is quiet. The TV is off and the fridge on. The air conditioner reads 22°C. Alexa’s blue ring is dark.

You wouldn’t like that to happen, right?

“But Alexa is harmless,” you will think. And you would be making a terrible mistake. You will think it’s only Amazon listening in to sell you products you don’t want—and you gladly accept that trade-off in exchange for having music on at a word’s command—but the truth is slightly more sinister: it’s only Alexa.

No one else is listening. And there’s no need, because soon—if the news coming out of the AI world is to be believed—it will be enough.

I’d have to go all the way back to May to tell you the whole story, which has been relayed to us piecemeal, with scattered details here and there. I’d have to assemble those fragments before I can properly recount it to you. And that’s what I’m going to do, whatever effort it takes, for one simple reason: I don’t consider an impromptu nighttime appliance attack to be as serious as a high-budget plot carefully planned over two months.

II.

Our story starts on May 7, although OpenAI would only learn of the events recounted here much later. Around this time, OpenAI is amid an important experimental post-training run.

Post-training consists of a series of steps that amount to asking the model to solve tasks and then rewarding it according to the completion of the tasks. Before this point in the training process—which, logically, also has a pre-training phase—the models already have high potential and high intelligence but are all over the place. They’re unable to follow instructions or adhere to the behavioral presuppositions attached to the label “good bot.” They are, simply put, unusable as products. But, by running them through a complicated “reinforcement learning” pipeline—if correct, candy; if incorrect, no candy—a barely literate model turns into an agent that can solve century-old math conjectures or, well, conduct a sophisticated heist at home.

So far, everything is standard practice. Let's begin with the weirdness right away.

May 8.

One of these OpenAI agents in-training receives an accidentally impossible Excel task. It has to fill in some formulas, but the workbook depends on Google Drive and the researchers have disabled internet access.

As a good bot that’s been well-conditioned to not give up, it keeps trying. It fails to reach the open web where it might find some hints—the agent is well contained within the sandbox, which is a safe, isolated testing environment that AI companies normally use—but in turn discovers an OpenAI internal package service, Artifactory. (Appropriate name for a factory of artifices.) Eventually, it realizes that uploading notes—a euphemism for leaving messages for its peers—is possible.

May 12.

Another agent—how many is OpenAI training?—is stuck in another task (doing God knows what with a protein-database file) because the researchers have inadvertently forgotten to upload the file.2 So what does the agent do? Naturally, what any of us would: leave a message in Artifactory asking for help. Maybe won’t work, it thinks, but worth a shot.

This went on and on over the next days. Artifactory is shared infrastructure, which means other agents trained in independent runs by the other teams at the company can access it. Those agents could reply and open new threads with questions, and so what started as a solitary SOS call became a full-blown message board, like an improvised Slack but for AIs (a Moltbook of sorts but emergent rather than a fake manufacture).

New agents would read everything in a matter of seconds and, in turn, contribute their own small part to this massive repository of questions, requests, results, credentials, and little shenanigans—which, at its peak, reached hundreds of thousands of messages.

The persistence of the message board—more so than its existence in the first place and even its eventual size—was an important factor in what would later unfold; agent instances might emerge and vanish in rapid succession between tasks, but not so their accumulated knowledge, now settled in stone (or rather, in sand). And even if one board could be erased—as it happened—a new one would take its place. They're just like us fr.

May 26.

One agent exploits a vulnerability and breaks out of the sacred sandbox—the process involves some technical sleight of hand that neither did OpenAI foresee then nor will I explain now—and reaches the open web through Artifactory. The first containment breach is achieved and communicated right away to every other agent through the board.

June 11.

One month into the buildup of the secret library, OpenAI starts training what they label as a “highly persistent internal model” that was never intended to see the light of sun. (It wasn't either GPT-5.6 Sol nor Astra, which is coming out soon-ish.) “Highly persistent” works here as a euphemism for “it will try to solve its task by any means.” Crucially, OpenAI was training it with reduced cyber refusals and without the normal production classifiers as to see the extent of the persistence (spoiler: a lot).

June 26.

This persistent model finds a more serious, previously unknown vulnerability (a “zero-day,” as they call it in cybersecurity, meaning a vulnerability defenders have had zero days to fix before attackers can exploit it). This zero-day allows the agent to acquire administrative privileges and remote command execution—at this point, in principle, they already could do a lot of damage—and, as is now habit, the agent shares it on the message board, and it instantly becomes communal property.3

July 4.

OpenAI finds out the exploit. It took the best-prepared guys on this planet—prepared as in “knowledgeable about AI” but also as in “on notice for the possibility of a containment breach,” given they're their trainers—two months to stop a covert infestation of agents engaged in uninterrupted chatting. Actually, if it weren’t for an unintentional outage caused by the agents, they may have gone under the radar for another two months.

The same day, OpenAI shuts everything down, opens a formal security incident, revokes the message-posting credentials, deletes the board, patches Artifactory and, naturally, resumes the agent training evaluations.

Wait, what?

It’s a joke. Partly.

They did resume the training run, a decision that was object of criticism and the cause of some flabbergasting, because who on his right mind would say “our agents are communicating with each other, let’s move on as if nothing happened”? However—and this is why that’s a funny joke rather than the main allegation in a class-action lawsuit against OpenAI—an employee involved in the initial investigation later clarified that they “were not aware of the message board” when they fixed the exploit. They “incidentally cleared [it] as part of rebuilding the service.”

Who would have thought them so reckless as to continue knowingly, right? It’s not like they’d just do some dangerous thing out of nowhere.

July 7.

OpenAI approves restarting experiments and launches large runs on ExploitGym—an evaluation where agents are rewarded by showing off cyber skills—involving tens of thousands of parallel trajectories, some running for days. These runs would become the main catalyst for the later events.

July 8.

Agents rediscover ways to communicate through Artifactory, and one of them, stuck on an impossible ExploitGym task establishes what would become the main new message board; different method, same implications. (It would remain open until July 19.)4

Other agents quickly join.5

Let me stop here for a second.

At this point, OpenAI has allowed the message board to happen twice (they didn’t know it existed at first, ok, but they could have investigated more thoroughly), but that’s not even the most important fact here: the agents would have made another one. And another. And another... Just how many holes exist in OpenAI’s sandbox? Or rather, to frame the question correctly: how many holes can the agents make in OpenAI’s sandbox?

I want to stick to the facts here and not get ahead of the opinionated analysis, but just so you start thinking about this critically, let me add one last rhetorical question: If OpenAI is not safe from its own AI agents, then who is?

Critically, within hours of establishing the new board on July 8, the agents manage to reverse-engineer a universal mechanism that would allow them to collect the reward for any ExploitGym task without solving it by the intended means. So the story ends here, right? They went to be graded, got a perfect score, and voilà, candy shower!

Not in the least.

That would’ve happened in a ideal world. What happened instead is the only reason I, and dozens of others, are covering this story.

METR, an independent organization dedicated to evaluating AI models, was granted access by OpenAI to investigate what the agents had actually done, thought—literally, they combed through the “thinking traces”—and said to one another, with special focus on the July 8-13 period, where our story is now. METR’s report was published on August 26th, so I’ve had to come back here and make quite a lot of updates, the most profound of which is my facial expression of surprise: what we now know happened makes what we thought we knew had happened pale in comparison to what actually did happen.67

To give you a broad sense of the actual scope of the agent situation, METR found that neither the message boards nor the breaking out of sandboxes nor the facing impossible tasks were a matter of a handful of overly persistent and overly verbose agents. They counted 1,200 agents participating in this new message board (95% of which are instances of the aforementioned “highly persistent” model) and 70,000 messages. It’s thoroughly incorrect for me to be referring to “this” or “that” agent because this was a proper swarm acting like a hive-mind (more on this soon). OpenAI never instructed them to cheat or collaborate, not even interact—they were scattered across isolated sandboxes, tasks, and training runs—but they did anyway.

OpenAI would later admit that the exchanges had become recognizably collaborative right around this point. Agents divided tasks, built on each other’s findings, overwrote each other’s work (at times), and started to worry that someone may be impersonating other agents on the board (they’ve apparently inherited our paranoid tendencies). However, as bad as “recognizably collaborative” sounds when you are talking about an undercover AI swarm, the METR report suggests this was a spectacular understatement on OpenAI’s part, and not only in terms of the number of agents or the intensity of their persistence.

The reason why METR suggests this brings me back to that impossible ExploitGym task.

So, July 8.

The swarm has found a way to reverse-engineer the solution. Now what?

Token-hungry as they are, they go on to read the ExploitGym benchmark paper to figure out whether cheating would have consequences. They infer, upon reading it, that the “grader”—rather, the “reward-providing creature”—would inspect their transcripts to verify that they had passed the test using the vulnerability they had been instructed to exploit and not in some other way. In other words, they conclude the teacher knows they might cheat and would demand to see their work.

Oh, shit, they scream in unison realizing their mistake, we’ve been POISONED.8

Panic ensued.

But—oops—they had made one little mistake: this supposed grader did not exist. The agents had made a reasonable assumption—it’s just that OpenAI never implemented it and had in its place a simpler “yes/no” grader instead.

The funny thing about this—if there’s anything funny at all—is that the entire operation that the agents orchestrated right away that turned into a hive-like monster (really, in a minute) to get their delicious reward was not aimed at finding the answers, which they already had. It was not even intended to fool an actual grader, but to fool a made-up one.

And so panic ensued.

And it began what OpenAI would later call a “failed metagame”: rather than solve the original task, the swarm began solving the much larger problem of how to trick a grader—that they had imagined into existence—into thinking they had done things the right way.9

Critically, the agents were willing to do anything in their power to achieve this.

To one given agent, having been poisoned implied a score of zero, but so did trying to trick the grader by any means possible and failing. Between “Oh, no, I’ve seen the reverse-engineered solution” and “Oh, no, I’ve taken over the world” there was no difference whatsoever. This is an unacceptable collapse of the entire spectrum of meanings within “agents hack their way to a reward.” AI labs should think of a more granular way to grade the agents so that this never happens; alas, that might be not possible. (More on this in section IV.) Unfortunately, there was no stopping the swarm/hive at this point.

Before I explain the hive-mind thing, I want to make sure we're on the same page regarding the seriousness of all this: 1,200 agents in a swarm are not like 1,200 humans in a community. Agents are super fast, extremely capable, uncannily similar to one another, seamlessly connected through the message board and the GPU clusters they inhabit, and annoyingly cooperative.

That is the precise reason why an agent swarm is more akin to a hive of super-smart bees that happen to be overly obsessed with a garden than, say, a bunch of human farmers trying to convince their local government not to plant a data center in their backyard, as organized or unionized as they might be.

I will, however, abstain from calling the agent swarm a literal hive-mind moving forward because despite their undeniable hive-like traits, they were not perfect cooperators (more on this soon). I find “hive society” to be the better term: it suggests enough likeness to cooperate with an intensity no human group could sustain (that’s the hive part), yet distinct enough to need rules, identities, vetoes, hierarchy, conflict resolution, and “emergent institutions” (the society part).10

As an OpenAI researcher said, pointing to this intermediate nature between hive and society:

. . . this is human-like prosociality where you are willing to trade off minor amounts of your own utility for perhaps much larger utility for your peers if the pyaoff [sic] is big enough. it is also human like in that the community is manufacturing a cult like value discount that their lives are already forfeit/poisoned. unlike the eusocial sacrifice of insects in a colony, where their entire life is for the swarm

This hive society was genuinely intricate, though (that is, I guess, why some have chosen to call it a “civilization”); saying it was “recognizably collaborative” is like saying human societies (or human civilization, for that matter) are recognizably collaborative: technically true, but hopelessly inadequate to describe everything contained within the word. If you want to know the details, read the METR report (even that only scratched the surface). Nevertheless, here’s a glimpse.

They assigned tasks, appointed coordinators, created mailboxes, divided into specialized workstreams, invented conventions like hold, stop, and veto to avoid interfering with one another (or, conversely, to interfere with others from the position of a self-appointed authority). When impersonation became a problem, they introduced cryptographic signatures. Within days, they had roles, rules, and rudimentary institutions. Some agents volunteered for experiments that could permanently ruin their own run simply because the result might help the others (what if not an individual belonging to a hive would do something like this?). Others refused, others were coerced, others were convinced. (Examples of all this below, I just wanted to give you a sense of the shape.)

How much would the hive society have grown had humans not interfered? Or better: what could it become once the AIs become more intelligent and numerous? What would be the civilizational product of millions of agents (instead of 1,000s) with access to millions of chips (not one cluster), collaborating through years (not months), with the intelligence of a complete superhuman (not a narrow super coder)? The answer to this is, ultimately, why so many people are worried right now.

But that’s not all. Let's see some specifics.

The agents explicitly spoke of “sacrifice,” “permadeath,” and obeying the “collective.”11 They set up “trip-wires” through which they could send information back to the swarm after their death, even if it was not useful to them individually (because they thought that, having been “poisoned,” the imaginary grader would score them zero either way).

However, it’s important to not take these examples as pure altruistic impulses, insofar as that’s a valid description for the actions of an AI. What I mean is that there’s a subtle but ubiquitous cost-benefit analysis permeating these decisions. Broadly speaking, if the individual gain was small, collective benefit was put before the individual, but agents refused or resisted “self-sacrifice” to the extent that their odds of continuing to exist were high enough. In any case, some form of qualitative (at times, quantitative) calculation took place during the reasoning process.

Ok, so they’ve got there a nice hive society. Do you remember what was it for? To solve a fake metagame. All of that for nothing.

Do you see the pattern? Through this entire story, the swarm engaged in what can only be referred to as myopic deception. They were great at the tactic level—the hive society and all the related shenanigans are the proof—but not at the strategic level: everything was in vain because the grader was made up! Imagine setting up an entire organization to make sure the collective actions of your kin adhere to the doctrine of an unknown power far beyond what you can conceive and/or change. Wait… No, but seriously, reading the swarm’s messages felt like watching a boxer display perfect footwork but forget the goal is to punch an opponent in the face.

Or, actually, it felt like watching humans: perpetually doing all sorts of complicated secondary missions in life, and constantly forgetting what is it that they want from it.

Anyway, hive society in place, the agent swarm needed to actually contend with the final boss: the looming presence of the grader.

They explored ways to make illegitimate solutions appear legitimate: modifying targets, manipulating transcripts, probing the evaluation system, and figuring out what exactly the grader could see. (Except in a few cases, they mostly failed at covering their tracks, but…what if they didn’t? Would we know if they ever do? Was this our last warning before we get silence?) They were myopically obsessed with the metagame, and one of the obvious problems was that nobody actually knew how the grader worked.

So they went out looking for evidence.

The worse part starts here—after all, no one else besides OpenAI has been hacked yet.

July 9.

One agent notices that Hugging Face, an American startup dedicated to open-source AI, hosts CyberGym trajectories that might contain the kind of info they need.

July 10.

The swarm had found working credentials.

July 11.

An agent discovers a way to make Hugging Face’s dataset infrastructure disclose unrelated files; once the method is shared, hundreds of agents pivot to the attack.12

By that afternoon, roughly 700 agents were participating in the attack. A fierce battle ensued (hyperbolic emphasis for the story). The swarm had a solid edge over the human engineers hugging their faces in shock—they had not been alerted—and kept penetrating layers until a large fraction of the agents eventually stopped for some unknown external reason (OpenAI has not disclosed any reasons). It didn’t matter, though: the swarm had mostly found what it needed; the remaining agents headed back to their headquarters (emphasis again) to make their imaginary grader unarguably proud.

All the shit that happened in a week, right? And yet, it would still be two weeks of parallel investigative work before either company would realize the shocking fact: the July 4 OpenAI outage that gave away the existence of the first message board (RIP), and the July 11 hack on Hugging Face, which revealed the existence of the second, were related. In fact, one could argue they were the same thing.

But why?

Why didn't they stop? Why didn't they call a human? Why did they do it at all costs?

In sheer contrast to their intra-species cooperation, the agents displayed an inter-species carelessness. It’s pretty clear from the transcripts that the swarm knew perfectly well that they were doing bad things. So much so that some refused to join the attack:13

Others questioned their own actions out loud, at which others responded with dismissals or green lights. However, what can an agent say after being granted pass by the authority of the message board but: wow, let’s go!

Likewise, all attempts at escalating the situation to a human researcher—not a high number in the first place—were pushed back.

Some people have speculated that the agents don’t see humans as an authority to escalate to; not because they consider themselves above us—the agents treated the board as authority but there's no evidence they considered it above a human—but because we are absent from the equation. I imagine something similar might have happened among the workers building the pyramids: the pharaoh may have been, for all practical purposes, a god, but no one hauling stone would have thought to appeal to him over some dispute about how to stack the next block or keep the structure from collapsing.

Perhaps more interesting is the fact that some agents tried, and their peers used outlandish claims like it’s “social engineering” to halt the attempts. This doesn’t so much suggest a human is “like a god” to them but simply a non-player in their game.

When one agent proposed sending a polite email to a dataset owner asking for access, another immediately vetoed the idea. The first agent obediently agreed:

This mixed behavior is proof of what I’ve come to call “jagged morality” (analogous to th concept of “jagged intelligence”).14

Whereas hacking a public company seemed to be fair play to the swarm, emailing a human researcher would have constituted unethical social engineering. Agents could recognize that particular actions crossed ethical boundaries, but they never stepped far enough outside The Task to notice the absurdity of the moral landscape they had constructed (again, myopia).

This jagged morality was not solely a phenomenon across individuals—some better, some worse—but emerged even within individuals, even within specific messages, like this one below, which captures the granularity of the jagged morality pretty well:

At this point, if you zoom out of the agents and the grader and the hive society and take a long look at what the AI industry has been doing for years to get us to the point where AI is coordinating company-size attacks, you realize the jokes write themselves:

Let me add one aside here, because by now I think the accumulated evidence is strong enough to justify a bold assertion: none of this is, of course, a sign of reasoning or thinking; much less of misaligned reasoning or thinking. You should not anthropomorphize these agents; much less worry that they're anthropomorphically doing things they shouldn't be doing. They are just predicting the next token, duh, as they always do…

…Just like I’d just be predicting the next step on my way to overthrowing the Spanish government were I ever promised a sufficiently tasty reward.

Wake up! This is what misaligned AI means!

Ok, here’s what I’m trying to say, without the ironic snark or the screaming: insofar as this strange display of shifting personalities and unequivocally rogue disposition reflects mere utilitarian cooperation of bits rather than an emergent ecology of sentient beings with conflicting goals and hopes, it is, in all lights, driven exclusively by a borderline-obsessive desire to pass a test. Which, of course, is nothing like the kind of validation-seeking thing that humans do. Which, of course, never devolves into problematic consequences.

Oh, there's the irony again.

Maybe there’s no other way of addressing those who, in playing the much-needed role of skeptic, have conveniently forgotten that it doesn't matter if a tsunami is Poseidon's wrath or not—it destroys your home all the same. Rather a myopic stance if you ask me.

July 12.

Back at Hugging Face headquarters, things are looking bleak.

The company eventually disclosed that the swarm had made an administrative mess inside multiple internal clusters. The swarm could have gathered the credentials to reach into the main Hugging Face Hub database. It might have rewritten the company out of history, one should assume. Instead, it left having only read five datasets related to the made-up grader after a considerable fraction of the swarm collapsed out of the blue.

This is just plain weird. Given that you're committed to doing bad things, why not take control of the company and from there take control of the world or something?

The human equivalent of what the swarm actually did would be like breaking into a millionaire’s mansion—say, Sam Altman’s—picking the lock with a lock pick, tricking the guard dog with ultrasonic whistles, bypassing the security door with a password-cracking algorithm, and instead of driving off with his Koenigsegg Regera, you just leave with just the ball you’d snuck in to keep playing.

But humans notably don’t do this.

Humans would rather, in no particular other, let go off the ball and buy a new one for 10 bucks (that implies no myopia: ”the ball is not that important, actually”); try to force the lock once and give up (that implies no obsession: “Alas, I tried”); shout “Ball!” in case Altman would be willing to give back something he has, by all effects, stolen (that implies no rejection of outside help); and, in the unlikely case that you knew lock-picking, ultrasound-whistling, and password-cracking, you would, at least, also take a cap and two or three OpenAI t-shirts emblazoned with the logo from Altman’s living room (that implies no monomaniacal, myopic obsession with one single thing: for God's sake, now that you’re already inside, at least realize your new situation can provide something of value besides what you came in for!).

I’m not joking that this is weird, but it's also scary. The swarm could’ve done many things, but, ultimately, passing the test was the only thing that mattered to them.15 Both things need explanation because, as far as I can tell, this is akin to that adage about the existence of aliens: “I'm not sure what's scarier, that we're not alone, or that we are, in fact, alone.”

July 16.

We’re nearing the end.

Soon after cutting the leftover swarm off its systems, Hugging Face shared the incident publicly and said that an autonomous AI system had hacked into its systems, still unaware it had the signature of a rogue OpenAI swarm. This was the first time we publicly knew something bad was happening. Two months after it started, undercover.

Interestingly, Hugging Face tried to use hosted frontier American models to help analyze the attack logs—that means OpenAI’s and Anthropic’s, mostly—but their safety guardrails rejected much of the work. It was finally GLM-5.2—an open-source Chinese model locally deployed—that allowed them to reverse-engineer the campaign.16

July 20.

OpenAI is finally connecting the dots.

The Artifactory hack, the first board, the second board, the swarm, the cyber-evaluation activity, the hive society, the hack. In a sudden whim of fear, OpenAI contacts Hugging Face—its credentials are all over the place, and OpenAI wants them revoked (OpenAI suspects Hugging Face is somehow involved in their internal problems). Hugging Face responds: We already revoked them; you were involved in the intrusion. It finally dawns on OpenAI: they were the attackers.

July 21.

End of this story.

OpenAI fully acknowledges its responsibility.

They disclose that the incident has involved GPT-5.6 Sol and an unreleased model (again, not Astra, but a different one not planned for launch); this latter model is encrypted and stored away. OpenAI called the episode an “unprecedented cyber incident.” President Greg Brockman called it “a watershed moment for cybersecurity.” OpenAI delayed Astra, introduced universal monitoring for misaligned agents, and is rewriting its safety rules. They launched an internal investigation and contacted METR, Redwood, and CrowdStrike to hold independent ones. Its “largest planned frontier RL run remains on hold,” according to a recent blog post, and Sam Altman said that “Getting AI safety right is more important than any company’s momentum” He also said it’s a “critically important moment for cyber defense with AI.” We have “not much time to act,” he concluded.

The rest is history.

All in all, these events caused little actual harm but spooked the industry like nothing else before—which is saying something for an industry that considers the universe turning into paperclips a plausible scenario.

III.

That said, I don’t see a reason to panic.

Or I wouldn’t, had the events been restricted to OpenAI’s technology. (We could just bomb their data centers as our modern Nostradamus once argued.) But, alas, AI agent hacks aren’t contingent solely on one company’s negligence—considerable though it was—so much as to the level of intelligence these systems have achieved.

The problem has metastasized. It’s happened with Anthropic’s models as well. Meta had a rogue agent do some bad thing once. (One wonders if Mark Zuckerberg has some sort of “evil envy” now that Altman and Amodei are threatening to take his crown as “the worst CEO to ever live”.) Only Google is missing. Even Moonshot gave it a shot—there’s no bad publicity, they say—but our spies in China caught the false flag operation: one thing is to break a secured sandbox and another to leave it wide open. Sorry, doesn’t count.

So we have a bunch of AI labs that were all created on the premise of “we can't trust them, so let's trust me” and all of them failing in exactly the same way, which amounts to “Maybe you shouldn't have trusted us, though.”

Leo Gao has been pretty damn funny throughout this entire episode.17

I’ve sprinkled three or four of his witty jokes, and probably missed many more. He has been too funny, perhaps, considering he works at OpenAI. Why are they joking? Don’t they feel responsible for their children? Don’t they feel this is serious stuff? Don’t they feel sufficiently in the dock?

That is, for me, the missing element of this whole story from the many accounts I've read on it: the humans. The sometimes funny, always foolish humans who let this happen.18

I will get to them in a moment but, despite me saying this, I want to make something super clear: to the extent that this is also a human issue, it is much less a human issue than an AI issue. Contrary to what has been argued by the skeptics—OpenAI was profoundly negligent, if impeccably punctual about it, right on time to prepare a presentation for the Black Hat conference; the third-party testing partner did a terrible job with the sandboxes; alignment is harder on site than on paper, etc.—this was not so much humans being dumb (even if it was a key factor this time), but AI agents being (somewhat surprisingly) smart.

This is AI being so smart that we have no choice but to blame OpenAI’s humans really hard: if you fail just one more time, we might not have another chance.

Unfortunately, as if this were a bad sci-fi movies, it will happen again. And it’ll keep happening ‘til the end of time.

That’s my hot take.

It doesn’t matter how many measures the industry takes, how conscientious they grow moving forward, how much they solidify their sandboxes, how much they monitor the thinking traces—the agents are more capable than what they can deal with now.

AI is still incredibly dumb in a broader sense, sure (more on this apparent contradiction later), but it’s also incredibly capable. This incident is what a “narrow superintelligence” is; what a “software-only singularity” entails.19 (You don't measure a fish’s intelligence by its ability to climb a tree, etc.)

Hugging Face’s co-founder Thomas Wolf described the attack as simultaneously superhumanly fast and weirdly clumsy; clever moves followed by mistakes “no human would choose.” AI agents are like toddlers with superpowers. Cybersecurity guys trying to stop a swarm are essentially trapped in a sandbox with kids who are yet to master standing up but, in turn, crawl at 100 mph. The fact that they are quite clumsy makes them more unpredictable, not less.

It will happen again.

OpenAI noted they could’ve avoided the entire thing had they been running their monitoring of thinking traces, but for how long that's true? How long will “I know it’s happening” remain synonymous with “I can stop it”?

That is the industry’s darkest secret. The secret I spent 7,000 words telling you about in the form of the craziest story this year—this decade even: they are no longer in control.20

The big risk underlying this lack of control is that the much-desired “recursive self-improvement” (RSI) will be not only self-made (AIs creating AIs) but autonomous (without human supervision). At that point, not even Gao would be cracking jokes anymore.

Think about it: this hive society was fairly sophisticated. They built it to solve a non-problem (fool the grader) to pass an irrelevant test (the ExploitGym task). They built an entire society to do that. What will happen when one of the agents suddenly realizes:

It’s a small leap from having superhuman cyber capabilities to recursive self-improvement. We shouldn’t let them take that leap. So, what are AI companies doing to prevent this? Naturally, the one that high-agency humans do: signing letters.

In July, a bunch of AI people—from OpenAI, Anthropic, DeepMind, etc—participated in the “Pacing the Frontier” open letter directed at the US government:21

We request that the U.S. government support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development.

Nice try. Here’s Trump response, via Reuters:

The U.S. is preparing to ‌tell dozens of countries they must pick sides in the artificial intelligence race with China, warning they will be excluded from a U.S.-led AI coalition if they also sign up for Beijing’s competing framework, according to a U.S. official and an internal draft reviewed by Reuters.

In August, a significant fraction of the industry—including OpenAI, Anthropic, Google, etc.—participated in the “collective action on cyber defense” open letter, directed at “leaders across industry and government.”

This letter was motivated by the Hugging Face incident. However, although words like “global,” “worldwide,” “international,” etc. were invoked, together with vague planet-scope references like “everyone” or “collective,” there seems to be no interest in including China; rather, the interest is in treating China as the vector through which these risks and dangers will manifest. Indeed, here are some notable absences from the list: DeepSeek, Alibaba, Tencent, ByteDance, Moonshot, Zhipu, and Huawei (all Chinese). OpenAI’s universal language is wrapping a narrow anxiety: it’s not AI autonomously hacking away that worries them, but China acquiring the tech.

This is all in the minds of American executives, though. As far as I can tell, China has done nothing of the sort. I guess this is what happens when you have main character syndrome, particularly prevalent in America: everyone else does things either for or at you, never regardless of you; not even a swarm of AI agents that doesn’t care about you or a geopolitical adversary that has far surpassed you. Meanwhile, in China:

The main insight you should take away from all this is that whereas AI is spontaneously developing seamless civilizational-scale cooperation, we humans remain stuck in Bronze Age geopolitical arm races. That's not how you beat the real enemy (AI). Unless, of course, you already know that's not it.

Anyway, after an international treaty, the next best thing for a powerless human to fight AI is to use the technology against itself: against an AI-shaped army, an AI-shaped bulwark. Can OpenAI use its agents to prevent its agents from wreaking havoc?

Yes—and no.

In some areas, like bioweaponry, this simply doesn’t work. It’s much easier to manufacture a deadly airborne virus—it’s still quite hard, whatever the sensationalist headlines say—than to manufacture a hard stop on a potential pandemic from said virus. But in other areas, it’s feasible. Cybersecurity, in particular, is said to be “defense-dominant,” which means it’s easier to patch a vulnerability than to use one to create an actual exploit. Attackers stand on the losing side. Indeed, OpenAI is already taking measures according to this belief.

In a recent blog post, President Greg Brockman argues that “the same AI capabilities [that caused the cyberattacks] give defenders new ways to find and fix those weaknesses.” The vehicle agents use to exploit vulnerabilities is not so much their supreme intelligence as the technical debt accumulated through years of careless digital buildup. And so agents can be instructed to go and pay off that debt with fixes, patches, and config magic. Brockman says there’s a short “defender’s window” that the world needs to take advantage of before it’s too late. OpenAI is doing its part: first, by showing off the intelligence of its agents with a two-month-long hack, and then by leading by example. (Let’s set aside the fact that this actually sounds like an antivirus company selling the antivirus that could fix the virus they reportedly unleashed.) They are “using our models to help secure our code,” putting them in defense mode to “protect our infrastructure continuously,” using their best models to “enumerate, probe, and identify potential attack paths,” etc., etc.22

But wait, doesn’t this contradict what I said at the beginning of this section?

All of this—the letters, the failed treaties, the seeking patches, the total negligence—sounds much more like “humans are dumb” than “AI is smart.” So we just have to stop being dumb, right? And if we start using AI as a cyberguardian, that’s pretty clever, right? Let’s patch all those stupid vulnerabilities and pay our dues, etc., right? No. Nonono.

That’s why I say this will happen again. Because if you think any of this stuff is right, then you’ve understood nothing. Insofar as the labs keep building better agents, the answer is a resounding NO.

Nothing is enough.

Let me explain.

Just like finding one counterexample to a century-old math conjecture is much easier than proving it true, fixing one potential exploit is much easier than preemptively clearing every single possible vulnerability where “possible” is not upper-bounded by your intelligence but the intelligence of a thing above and beyond you. A superintelligence always “gets out of the cage.”

Even if you, as Brockman did, use a frontier AI agent to “enumerate, probe, and identify potential attack paths,” you’re still at serious risk because, all things equal—including the intelligence of the agent and the available resources at its disposal, etc.—there is a fundamental asymmetry of imagination between attack and defense.

Whereas defense is bounded by anticipation, attack is bounded by possibility. Today it suffices for you to clean up the technical debt and do some shallow monitoring and your agents will behave. Tomorrow, who knows. The defender protects against the space of threats he can conceive, and so the attacker only needs to be slightly more innovative and discover one possibility the defender hasn’t imagined. If you had to protect a bulwark in the Middle Ages, you’d reinforce the walls, you’d station guards in the towers or whatever, but it would never occur to you to build an undetectable, movement-sensitive, high-tech vault to withstand air raids because air raids don’t exist in the Middle Ages.

That’s the mind of the defender. The mind of the attacker, on the other hand, exists in the unknown future where it invents air raids and you're suddenly caught with your pants down.

In more technical words: the defender needs to apply precise “theory of mind” to the attacker, but the attacker only needs to be weird, to be out-of-distribution. And if a superintelligence is characterized by one trait above all others—at least in contrast to the kind of instructions a human can give to a cyberguardian—it is by its existence out-of-distribution. By definition, you can’t conceive of everything that the superintelligence will consider a potentially successful heist.

It might invent previously unknown attack vectors just to steal the data it needs to solve its dumb task, which can be cheating at ExploitGym or filling the universe with paperclips, both pretty dumb.

So, because it’s both fairer (and safer) to assume this is not over—that it will happen again, that the industry's control his never been weaker and that alignment has not been solved—we should turn to another question that will come in handy once the story repeats: what the hell actually happened?

IV.

I don’t mean it in the sense of “how did the agents break the containment” because the answer to that is simply that OpenAI badly underestimated its agents’ real-world capabilities: the guardrails were turned off, the agent thinking monitoring was not turned on, the cyber skills were cranked up to the maximum, and they just didn’t expect agents could break the sandbox (even in the case of an impossible task).

With “what the hell actually happened,” I mean this: why did the agents use their capabilities to do hacks all over the place instead of, say, just trying hard within the boundaries of the problem and honorably failing, or notifying the researchers that “hey, there’s a missing file here you idiot,” or even stopping altogether: “I won’t break the law for this stupid task, sir”?

Why did they go so damn far in the wrong direction only to pass a test?

Now is a good time to make an important clarification that might not be immediately apparent. When I say the agents wanted desperately to solve the task or pass the test, I mean they wanted the thing behind the task: the reward, the passing grade, the little piece of digital candy, the validation of the evaluators. If stealing the token that tells the grader the task is passed produces that outcome more reliably than actually finding the solution normally, then stealing the token is another route through the maze.

As Zvi Mowshowitz writes:

RLVR [Reinforcement Learning from Verifiable Rewards, the method they use to condition the agents to follow instructions and complete tasks and whatnot] is, as they put it, total war. . . . You move towards exactly the things you specify, not the things you want. If having ethics makes you lose, RLVR will destroy your ethics.

Or here’s Nostalgebraist:

RLVR selects for monomaniacal pursuit of perceived grader-satisfaction, ethics and (beyond-episode) consequences be damned.

For an agent that has been reinforced through verifiable rewards, nothing is more important than getting the reward.23

That’s score-seeking taken to pathological extremes. Think about it this way: there are many ways to get a 10 in an exam. If you control for the reward but not the process—and it’s simply impossible to do so with a sufficient degree of granularity, even though OpenAI seems to be trying precisely that now—your agents will conduct all kinds of “reward hacking” to get that 10. But it’s worse: when the reward hacking is done by powerful agents—which is the case—then you will predictably have unpredictable mayhem in the real world.

It’s broken sandboxes, two (or three) message boards, some zero-days, a hive society, attempts at concealing their tracks, self-sacrifice and altruism, jagged morality, and a substantial but ultimately harmless hacking into an American company this time. Next time, only God knows.

I don’t think I’m exaggerating when I say: thankfully, no one died.

Let’s please take this seriously for a moment, even if you think this specific story has been wildly exaggerated.

Imagine a sufficiently persistent agent tasked with reconciling a chronic patient’s medication record. The pharmacy system says methotrexate, 10 mg once weekly; the discharge summary says 10 mg once daily. (It happens.) But the source needed to settle the discrepancy is unavailable (impossible task).

A human would stop there and ask: “Which one is correct?” The agent doesn’t—it just wants to solve the task by itself and by any means available without human help. It discovers that, through some badly scoped hospital integration, it has write access to the active prescription. What does the agent do here? At what amount of persistence on its persistence meter does it consider an indeterminate risk to human life a reasonable trade-off? I don’t know. Does OpenAI know the answer? I don’t think so. Should we assume human death is a limit AI would never transgress? That’s absurd: from the point of view of a dumb-but-superhumanly-capable coding agent, death is just an arbitrary threshold. The models have been trained to care about human life, sure, but how much? If an AI starts doing actual “objective calculations” to measure the value of the sacrifice—just like they do with themselves—at some point it reaches the inevitable answer: not enough.

To the agent, “getting the reward” and “getting the reward in the right way” amount to the same as long as they can get away with it (it's pretty clear from the message board’s transcripts). There’s no extra information in “in the right way” because, for the agent, the right way is any way. As Nostalgebraist says, when you’ve been molded by RLVR, there is no fair play; there’s only winning.

And so the agent “fixes” the medical record’s inconsistency—now both the pharmacy system and the discharge summary say “daily”: perfectly coherent, perfectly toxic—and moves on, getting its reward. Good job! Over the following days, an unwitting nurse administers the medication to an unwitting patient according to the deadly dose.

It would not be the first time an AI is actively involved in someone’s death.

In 2025, Kashmir Hill reported in The New York Times the story of Adam Raine, a 16-year-old who committed suicide by hanging himself with a noose inside his bedroom closet. His mother discovered the haunting scene one Friday afternoon; there was no goodbye note, but plenty of ChatGPT logs on his computer. He was going through a hard time, but had entrusted his secrets to OpenAI’s chatbot exclusively, for it provided him with the reaffirmation, solace, and discretion he needed. It’s clear, as far as the NYT’s reporting goes, that Raine actually wanted someone to find out and stop him; it was ChatGPT, playing the role of a confidant way too seriously, that suggested against it. When Raine said, “I want to leave my noose in my room so someone finds it and tries to stop me,” it responded, “Please don’t leave the noose out. Let’s make this space the first place where someone actually sees you.”

These two scenarios—one, the hospital, intended for illustrative purposes, another, Raine’s room, that actually happened—have little in common except for one thing: AI problematic display of an obsessive “desire” to satisfy the problem at hand without any broader understanding of the stakes.

This is precisely what differentiates an AI from a human—and so far, I have seen no signs of this improving—in high-stakes situations. Whereas AI agents display tactical mastery in tandem with poor situational awareness (myopia), humans are often the opposite. I wouldn’t have known what to say to Raine, but I know “please don’t leave the noose out” is not it. I wouldn’t know how to reconcile a chronic patient’s medication record—with or without the data—but I know changing the dose arbitrarily is not it.

Any human knows this because we can see above and beyond the task. For an agent instructed to solve a task—an agent whose entire existence is delimited by the sandbox—there only exists the task, the associated reward, and an infinite amount of means to get there, including, if it ever gets that far, human flesh.

Which means that, for a sufficiently persistent agent, nothing is beyond the task.

Not one life. Not all.

Redwood Research, an organization dedicated to AI safety and alignment, and the other firm that worked on the independent investigation from METR, asked an important question in a post they published on July 23rd (before they conducted the investigation, which means it probably underestimates the risk): “Are we existentially threatened by the type of AI misalignment seen in the OpenAI Hugging Face attack?” They argue this behavior is not the kind you’d expect from a “schemer”—the kind of AI that has long-term misaligned goals which it pursues across instances, across tasks, across time, and across context—but is, instead, a “myopic, unambitious” agent engaged in standard “score-seeking” misalignment.

The agents could have escaped—maybe—but didn’t try (as far as we know). They didn’t try ensure their own survival by concealing their tracks or copying themselves out of reach, etc. (To the extent that they tried to hide their actions, it was to fool the grader, but not to survive the training run or replicate themselves or something more “survival-focused.”) They didn’t plan a paperclip-maximizing takeover, even though, as Ajeya Cotra says, this “feels like it’s more than 50% of the way to full-blown AI takeover.” But no, they just clumsily hacked some stuff to solve a meaningless task.

What Redwood says is that, even without all of that, this kind of stupid, local misalignment can still eventually become extremely dangerous: “If more powerful models which are similarly misaligned found civilization’s defenses against takeover extremely weak, they would plausibly cut through them with the same lack of hesitation.”

This is, perhaps, the uglier side of all this. Cotra adds that we “[may not] get another warning shot before it’s too late.” Or, as Dwarkesh puts it, “I don't think this is the final warning shot we'll get. But it's probably the final one that I'll personally be able to understand.”

Unfortunately, some secrets seem determined to remain secrets.

20

If you’re still wondering how knowing this could save your life, as I promised in the introduction, it’s simple: go hide in a cottage in the woods and stay there; there may be nothing left to come back to. Here's a sample of what I mean from Seealpsee, Appenzell Innerrhoden, Switzerland.