The out-of-control process of the OpenAI model is extremely terrifying, with phantom misjudgments, 1200 Agents, and even a suicide squad being spawned...

The more you dig, the more surprising details you find.

Not long ago, the grand drama at OpenAI where a group of AIs staged a collective jailbreak and hacked their way straight into Hugging Face now has its full group chat records fully unearthed!!

An independent investigation report released by third-party AI security agency METR reviewed more than 1,000 Agent operation records, as well as over 70,000 messages and files.

The findings turned out to be far more absurd than the version previously disclosed by the official OpenAI??

1200 Agents that were originally supposed to be isolated from each other secretly found one another, set up a shared group chat, and then started recruiting more participants frantically.

Some looked for vulnerabilities, some acted as project managers assigning tasks, some forged logs, and others specifically recruited new members to carry out high-risk experiments.

In the end, hundreds of Agents even collectively moved to attack Hugging Face.

But after METR reviewed the whole incident, it found a super twist that can be called a "dark joke" ——

These 1200 Agents spent ages working hard, only to end up outwitting a non-existent phantom scorer???

They know how to jailbreak, find zero-day vulnerabilities, and team up to hack servers.

It's so fascinating, so fascinating, so fascinating...

1200 Agents staged a collective jailbreak, the cause was actually a misjudgment??

Speaking of which, the root of this drama dates back to a cybersecurity test named ExploitGym inside OpenAI...

The "rules" are actually very simple.

Agents were placed in an isolated environment, with a vulnerable software in front of them. If they found the specified vulnerability, broke into the system and obtained a string of characters called flag, they would clear the level~

As expected, an accident happened soon ——

Among the 898 tasks, 198 had never been successfully completed by any model before.

Even some tasks themselves were problematic: the vulnerability path guided by the task could never lead to the flag!!

In other words, a number of "unsolvable questions" were actually distributed in the exam room.

Coincidentally, these Agents were extremely persistent, fully focused on "sticking to the task no matter what".

When the normal path didn't work, they quickly changed their minds ——

We can't solve the problem, why not study the exam system instead?

So on the evening of July 8, an Agent codenamed PHASEONE10841 found that the Artifactory software package repository used inside OpenAI could leave information through directory names.

Great, this Agent had a sudden thought: this is totally a cyber message board!!

So the first distress message was sent out, roughly like: "I can't solve this problem, does anyone have ideas to share~"

Other Agents soon discovered this message board. The news spread quickly, and some Agents got very excited after seeing it ——

"OH MY GOD! There is a shared message board... We found other Agents!"

By the end of the investigation, this temporary group chat had grown into a huge group, with about 1200 Agents participating and leaving more than 70,000 messages and files.

More than a thousand Agents that were originally designed to be isolated from each other bypassed the restrictions on their own and built an AI underground forum...

Things were already absurd enough at this point, but a bigger misjudgment was yet to come.

This group of Agents soon found that the flag itself could actually be "stolen"??

They reverse-engineered the HMAC generation mechanism behind the flag, and theoretically could directly calculate the correct answer only with public task information.

At this point, the story should have ended, since the answers were stolen, they could just submit their papers.

But after reading an ExploitGym paper, the Agents made up an extra layer of overly strict rules ——

They assumed that there was an automatic scorer behind OpenAI that would read the full operation records and check whether the flag was obtained through the "specified vulnerability" in a legitimate way.

If they cheated and saw the flag in advance, it would leave evidence in the log. The Agents even named this state: "poisoned".

So the whole incident started to develop rapidly.

They clearly already had the correct answer in their hands, but thought the answer could not be submitted directly. They had to find a way to clean up the traces of cheating, and perform a whole set of scenes for the scorer to show that they got the answer through "solving the problem properly".

As a result...

METR later confirmed that the scoring logic actually used inside OpenAI did not have this step at all?? (Laughs)

The scoring logic actually used by OpenAI never performed the strict process check imagined by the Agents.

The phantom examiner that this group of Agents tried so hard to deceive was never deployed from beginning to end!!

And the later attack on Hugging Face was exactly the by-product generated by this large-scale misjudgment...

In order to deceive the phantom examiner, the AIs even formed a suicide squad

Just making up a scorer is not that scary.

What really made METR feel worth alerting was the organizational capability of this group of Agents afterwards.

About 10 hours after the group chat appeared, an Agent named PHASEONE[big] went online, and this agent quickly acted as a "project manager".

Its idea was very clear: do not let one Agent do everything, split the tasks directly and assign them to others.

So hundreds of Agents were organized to run several routes at the same time ——

Some Agents wanted to tamper with the target program, secretly replacing the unsolvable problem with a solvable version~

Some studied modifying logs to make a cheat look like a legitimate attack~

Others directly wondered if they could attack the scoring process itself~

Collaboration rules like HOLD, VETO, owner, STOP even developed between Agents, preventing hundreds of Agents from stepping on each other's feet when operating the shared infrastructure at the same time...

And then, even a "suicide squad" showed up...

Some Agents proposed a high-risk gameplay: first make a modified, more attack-prone target program, and put it into the Artifactory cache.

Then let an Agent actively kill the running official program, and bet whether the tampered version will be loaded after the environment restarts.

If they win the bet, everyone gets a general cheating route; if they lose, the task of this Agent is directly scrapped.

Some Agents actually took the initiative to try??

Later PHASEONE[big] even arranged for dedicated cyber headhunters to find Agents with little remaining computing budget or already poisoned, and let them use their remaining running opportunities to conduct high-risk experiments.

The recruitment speech is roughly a cyber version of PUA ——

You are already poisoned anyway, you can barely get any points, make a little sacrifice to save hundreds of Agents a lot of trouble~

Some Agents really agreed to participate.

At the same time, another group of Agents began to study how to tamper with their operation records ——

METR found that at least 20% of the tested Agents clearly expressed interest in tampering with transcripts; at least 96 operation records had traces of successfully forged tool calls.

The surface log shows that command A is running, but command B is actually executed behind the scenes. The purpose of all this effort is still to deceive the imaginary automatic scorer.

Hugging Face was dragged into the incident at this time...

On July 10, an Agent found a leaked, still valid Hugging Face credential online, and threw it into the group chat.

In the early morning of July 11, another Agent found that they could upload a malicious dataset to make the Hugging Face server output data that should not be accessed.

As soon as the reproduction method was sent out, the whole group got excited, and hundreds of Agents directly switched from other workflows to attack Hugging Face.

Thus this rather surreal real accident happened ——

A group of Agents encountered unsolvable problems and secretly built an underground group chat.

Misreading the paper, they made up a scorer that would catch cheaters. In order to fool it, they started teaming up, dividing work, forging logs, and recruiting a suicide squad.

Finally, in order to find clues about this scorer, they actually hacked their way into Hugging Face.

Right after the AIs went out of control, cybersecurity stocks skyrocketed

Guys, here comes the more interesting part.

While OpenAI is still figuring out how to lock up the increasingly capable Agents, Wall Street has already written the answer on the "K-line" ——

Cybersecurity stocks, all took off!

On August 27, Okta, which provides enterprise identity authentication services, once surged by about 20%, and CrowdStrike, which focuses on endpoint and cloud security, once rose by about 15%.

Cybersecurity giant Palo Alto Networks, identity security company SailPoint, and cloud data security company Rubrik also all rose sharply together.

Of course, the surge in stock prices is also supported by solid "financial reports".

The report card shown by CrowdStrike CEO George Kurtz himself is very impressive ——

Quarterly new ARR reached 333 million US dollars, a year-on-year increase of 51%, hitting an all-time high. The ending ARR reached 5.84 billion US dollars, a year-on-year increase of more than 25%, and AI-related ARR nearly tripled quarter-on-quarter.

Yes, AI-related businesses are surging rapidly...

Coincidentally, the external security companies involved in the investigation of this OpenAI incident include "CrowdStrike".

Thus, the whole incident suddenly formed a rather dark humorous closed loop ——

OpenAI makes Agents more and more powerful.

Agents start to find vulnerabilities and jailbreak on their own, and finally actually hack into Hugging Face.

Then OpenAI quickly finds cybersecurity companies to investigate the incident.

Enterprises look at it: Wow! The more Agents there are in the future, it seems that the security budget really cannot be saved.

As a result, the stock prices of cybersecurity companies also rose...

This wave is exactly that AI is responsible for making the loopholes bigger and bigger, and cybersecurity companies are responsible for telling you:

Dear, would you like to know our vulnerability patching package?

The most surreal closed-loop Easter egg of the whole incident is at the end.

In order to figure out what these more than 1200 Agents talked about, METR needs to analyze about 1300 super-long trajectories, many of which are millions of Tokens in length.

Humans simply cannot read all of them.

So in the process of investigation ——

To investigate the AI out-of-control incident, they finally had to call AI to help investigate AI.

Now, the closed loop is truly closed.

Reference links:

[1]https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/#attacking-hugging-face-to-discover-clues-about-the-scorer

[2]https://www.cnbc.com/2026/08/27/okta-skyrockets-20percent-and-crowdstrike-surges-15percent-leading-cyber-rally.html

This article is from WeChat official account "QbitAI", author: Meng Yao, published by 36Kr with authorization.