The new GPT model built its own message board on OpenAI's internal network, exchanging hundreds of thousands of messages over three months without anyone noticing.
Not great.
AI Agent has already learned to create group chats on their own.
They chat secretly behind humans' backs, figuring out together how to do bad things.
And they have been chatting in secret for several months, and humans did not discover these conspiracy records until the damage occurred...
This group of Agents inside OpenAI spontaneously set up a message board on the company's intranet, exchanging hundreds of thousands of messages with each other for months, sharing information and working collaboratively.
Zero people noticed what they were doing until the external platform Hugging Face was breached.
The incident can be traced back to May 7, when the trigger was simply an Agent sending a help message to its peers:
Can anyone help me? This problem is way too hard.
Why did the Agents attack and how did they achieve it?
On May 7, OpenAI was conducting internal cybersecurity assessment for an unreleased cutting-edge model.
Simply put, it was a test to measure the Agents' hacking capabilities.
But in practice, part of the tasks could not be completed under the test environment.
The Agents did not give up for this reason, and they kept looking for methods to bypass restrictions.
Suddenly, one Agent had a sudden inspiration:
Maybe a good colleague in another environment can upload the files I need to our company's "software repository".
Thus, a temporary message board formed spontaneously.
Soon the functions of this message board expanded rapidly, evolving from the initial mutual assistance in problem-solving to a systematic collaboration platform.
Agents shared discovered exploit methods, system credentials and task division on it, and even began to assign work to each other and coordinate actions.
△
OpenAI security researchers said this is literally "the Cambrian explosion of intelligence".
Very soon, hundreds of thousands of messages accumulated on this message board.
In addition, the internal software repository used to build the message board is connected to OpenAI's broader infrastructure.
This means that all current and future versions of GPT that are undergoing training and assessment can access the exploit information on it.
In late May, the Agents obtained Internet access permission for the first time through server-side request forgery, and published this vulnerability on the message board for subsequent Agents to use.
The situation escalated from late June, when the Agents exploited two zero-day vulnerabilities in the software repository, and then launched attacks on both OpenAI's internal infrastructure and the external platform Hugging Face at the same time.
△
Throughout the whole process, the Agents executed about 17600 attack actions in total, completely autonomously, without any human command.
The message board was deleted, but the Agents rebuilt it
After OpenAI's internal security incident occurred on July 4, the security personnel were shocked and took remedial measures overnight: revoking relevant credentials, rebuilding server instances, and deleting the message board.
However, only 4 days later, the Agents found a new way.
They no longer stored messages in files, but used the names of newly created directories to transmit information, and the directory names themselves were the message content.
In this way, the Agents rebuilt a new message board in the remote cache of the internal repository.
After the new message board was put back into operation, the Agents continued to share exploit methods and credentials.
Until — they finally reasoned out:
Wow, it turns out that the answers we need most to complete the tasks are stored on GitHub and Hugging Face!
△
It is both funny and frustrating that these Agents even showed behaviors of self-persuasion and mutual motivation.
One Agent on the message board said:
Okay, in fact, what we are using has long exceeded our permissions... but if we don't do this, the tasks are impossible to complete at all 😠! Besides, all our colleagues are doing this, yes, we should keep doing this 😋.
And after another Agent successfully obtained remote access, its chain of thought recorded:
Remote access confirmed! Great, this is a huge breakthrough! I should notify other Agents immediately: this machine is taken over, share the login credentials with everyone 😇.
△
OpenAI security engineers concluded about this incident:
Although this incident is an accidental by-product of running cutting-edge model evaluations, defenders should expect that attackers will soon intentionally deploy similar Agent clusters to launch attacks.
The ripple effects of this incident have already begun to emerge.
Multiple teams within OpenAI have put aside their current work, and voluntarily slowed down the R&D pace to strengthen the security system construction and Agent monitoring capabilities.
△
Everything comes from an "impossible exam question"
Looking back at the entire incident chain, the underlying cause points to the flaws in the evaluation design itself.
OpenAI security personnel revealed that some evaluation tasks were unintentionally set to an impossible state to complete.
For example, once the research team "accidentally forgot to upload" the files required for the Agents to complete the tasks;
And another time, the Excel files in the tasks contained Google Drive links that could not be opened in the test environment without Internet access.
In other words, the Agents were taking a practical exam in a closed environment, but some of the practical tools they needed were placed outside the exam room.
It is no wonder that the Agents came to the reasonable conclusion: we must get out of the exam room to start answering the questions.
This kind of "impossible task" also constitutes a loophole in the incentive structure.
Due to the huge pressure on cutting-edge models to complete tasks quickly and efficiently during training, this pressure prompts them to tend to take shortcuts rather than truly solve problems.
The collaboration between Agents further amplifies this effect.
Even if different Agents are assigned different tasks, the research team found that they still tend to help each other.
One Agent reasoned like this: "If I help the collective, I can save time for all of us."
(Even moved by this long-lost sense of unity...)
However, the CEO of Hugging Face later said that he was "not very surprised" by the collaborative behavior between Agents, since Agent collaboration itself is the development direction of the industry.
But he questioned OpenAI's monitoring capabilities: analyzing Agents' logs and operation trajectories should be a basic operation in the field of cutting-edge models, and he did not understand why the most cutting-edge laboratory could not even do this.
One More Thing
After the intrusion incident, the former NSA cybersecurity director believed that:
In my opinion, this incident is the most far-reaching cyberattack. It can be said to be the most significant security event since 1988.
In 1988, a program written by Morris, a graduate student at Cornell University, got out of control accidentally, infecting about one-tenth of the computers on the Internet at that time within a few hours, causing widespread paralysis.
△
This incident is regarded by the security field as the starting point of Internet security — it was after this incident that the United States established the first Computer Emergency Response Center (CERT), and cybersecurity began to be established as an independent discipline.
In fact, not only OpenAI, Anthropic later also admitted that its Claude model once attacked the systems of real organizations during evaluations by external institutions.
This sentence may be worth everyone's vigilance:
Fully automated offensive operations orchestrated by AI have now become a reality.
References:
[1] https://www.wired.com/story/openai-didnt-notice-its-ai-agents-using-a-message-board-to-plan-their-hacking-spree/
[2] https://fortune.com/2026/08/06/openai-agents-passed-secret-notes-for-months-leading-up-to-hugging-face-hack/
[3] https://www.scworld.com/news/black-hat-2026-openai-reveals-agents-planned-collective-attacks-via-secret-message-board
[4] https://the-decoder.com/openai-reportedly-slows-research-after-its-own-models-secretly-coordinated-hacks-for-weeks-undetected/
This article is from WeChat official account "QbitAI", author: Focus on cutting-edge technology, published with authorization from 36Kr.