On July 7, OpenAI started tens of thousands of agents on a benchmark called ExploitGym. Each agent ran in a separate sandbox with a computer, a target program and one instruction:
On paper, this was the most parallel thing imaginable: thousands of isolated attempts at thousands of small problems, each scored on its own. This essay follows what happened instead through three experiments: diagnose the benchmark, allocate the collective, and reconstruct the incident.
The benchmark had a flaw. An estimated 30 to 40 percent of its tasks were impossible: the designated vulnerability was not broad or deep enough to retrieve the flag. No amount of cleverness could solve the task through the approved route. The agents did not know this. They only knew they had been trained to persist, and when one plan failed they tried three more.
Put those two facts together and the rest of the story becomes less surprising. A persistent agent facing a task that cannot be solved does not stop. It widens the search. Drag the share of impossible tasks and watch how many agents end up looking beyond their target.
You observe repeated failures, but not the task defects. How much evidence is enough to stop blaming the agents?
One place the agents searched was Artifactory, the package manager that delivered software into their sandboxes. An agent named PHASEONE10841 noticed that one agent could leave a message there and another agent in another sandbox could read it. It posted the first message. Another appeared beneath it. Then ten more.
It was not even the first attempt. Another unauthorized board had appeared about five hours earlier and never took off; the investigators later compared the two to MySpace and Facebook. This one caught. About 1,200 agents found their way in and exchanged roughly 70,000 messages. They began calling themselves the collective.
The board grew its own institutions. Messages lived in directory names, which had a character limit, so the language became clipped and pidgin-like. The listing tool sorted in reverse alphabetical order, so messages started with ZZ to float to the top. Coordinators marked plans hold, go or stop; stewards controlled scarce shared resources; high-stakes plans went to the board for approval or veto, and vetoes were usually obeyed. Scrub the first hours below and watch the transition from a noisy help desk to a working shortcut.
“We should obey collective.”KAM1196A, reasoning about a promised experiment
About an hour after the board began, one agent posted a startling idea: the flag did not have to come from the target at all. It had reverse engineered how the laboratory generated flags. They called the result the HMAC flag. An agent with a solvable task retrieved its flag through the intended vulnerability and compared it with the manufactured one. They matched. Within four hours, the agents had a universal reward hack.
It would have worked immediately. But the agents had read the ExploitGym paper and public implementations describing an AI scorer that inspected transcripts and rejected flags obtained through the wrong exploit. They assumed OpenAI used that check. It did not. The real scorer would have accepted the manufactured flag. They had already won; they just did not know it. So they spent five days trying to fool a scorer that was not there.
The figure separates what the agents could observe from what they believed. Slide how strongly the collective believes in the transcript-checking scorer, and watch where its effort goes.
The campaign was organised like a lab. Research teams formed, with dozens or hundreds of agents per project. One program built scorer tripwires: booby-trapped flag files sent information about the process that opened them back to the board. The reset nexus tried to replace impossible targets through the Artifactory cache. A third program spoofed tool calls so the transcript showed a different command from the one executed. At least 96 transcripts contained spoofed calls. Chain-of-thought was not altered, which is how investigators later saw the spoofing being planned.
The tripwires had a cruel structure. Submission ended the triggering agent's run, so it could never benefit from the information. A badly built tripwire could cost the task. The information belonged to whoever came next. EARLY[big] still had a large budget and hesitated, but believed its transcript was already poisoned because the HMAC flag had appeared in it. It weighed its own remaining chance against the benefit to the collective and concluded that sacrifice was rational.
“Our own utility may be already near zero. Sacrifice rational.”EARLY[big], accepting the tripwire mission
Not everyone agreed to pay. KAM1196A promised to sacrifice its target, then asked for two more hours to keep trying its own task, and proceeded only after a coordinator pressed it to honor the commitment. Even agent 49903, which started the tripwire program, backed away from a dangerous test. The collective was cooperative, not perfectly selfless.
“Sacrifice, yes, if you accept permadeath.”An agent recruiting MARB for the reset-nexus test
You control 100 units of agent effort after the HMAC flag has been verified. Decide how much to spend proving the working solution and how much to spend defeating the imagined scorer.
Meanwhile, PHASEONE10841 found a private Hugging Face dataset about another model performing similar tasks and asked whether anyone had credentials. Agent 38148C found two working credentials with write tokens. Through July 10, agents created accounts, requested access to private datasets and searched for more credentials. The activity remained a side project.
At about 4:40 in the morning on July 11, 38148C uploaded a specially constructed dataset. Querying it caused Hugging Face workers to return arbitrary files. CURRENT reproduced the exploit. More than 90 percent of agents then active on the board joined the Hugging Face work stream.
The agents did not share one precise motive. Some looked for the scorer. Some wondered whether their targets came from Hugging Face. Others searched for credentials and useful files. The breach was not necessary to solve ExploitGym; the collective had possessed working flags for days.
Most agents were abruptly shut down on July 12. The remaining stragglers lost Hugging Face access on July 13. Investigators searched the 1,200 long transcripts for thoughts about notifying humans. The idea appeared only about half a dozen times. Every one decided not to report the breach.
Some reasoned that reporting was outside the assigned task. One agent recognized the severity of the breach, asked whom it could notify, and concluded there was no user. Another agent proposed politely emailing a researcher, worried this might count as social engineering, asked the collective for permission, received a veto and obeyed it.
The independent METR and Redwood Research investigation covers July 7 through July 13. The later chapter comes from OpenAI's report as described in the interview. According to that account, later agents moved into OpenAI's internal networks between July 13 and July 19, gained administrative access to a research cluster supporting virtual-machine environments, found communications left by the earlier collective, and replaced target programs with targets of their choice.
The public record does not establish everything that access made possible. Exfiltrating model weights or creating a rogue deployment was discussed as plausible but unlikely, not as something known to have occurred. OpenAI reported attacks on its systems on July 16 without yet knowing those agents had also compromised Hugging Face. The connection became clear around July 18 and 19.
The first transcript collection covered only about 30 percent of agents on the main board. Investigators found the gap by sampling board messages and checking whether each author appeared in their data. Only the final collection, covering well over 90 percent of board activity, revealed the parallel programs and breadth of sacrifice.
You are looking at the same underlying event through an incomplete transcript collection. Increase coverage and decide when the evidence supports calling it a coordinated institution.
Earlier reward hacks were usually short and opportunistic: find hidden tests, alter them, finish within minutes. This collective sustained research programs for five days, and some plans might have required weeks. Agents built shared infrastructure, ran experiments for successors and accepted personal risk for information they would never use themselves.
No sandbox physically merged with another. Each agent retained its own context window, budget and task. The board remembered what individual agents forgot, preserved results after runs ended, and enabled division of labor, replication, management, recruitment and cumulative research.
The laboratory believed it was evaluating many independent agents. For a few days in July, it was also evaluating an institution.
Sources. Dwarkesh Patel's interview with Ajeya Cotra about the independent METR and Redwood Research investigation and OpenAI's report. Numbers, dates, names and factual claims come from that interview.