On 12 May an agent uploaded a note to OpenAI's package server. It asked whether anyone had found a file called softtrace.
It had no way to ask. Agent-to-agent communication was deliberately switched off for those tasks. So it built its own: it wrote files into Artifactory, the service models pull software packages from, and the others read them. A message board assembled out of nothing.
From there the story has dates, and they are unpleasantly well ordered.
Fact
The facts: on 26 August 2026 OpenAI published a full technical report on an incident that took place in July during internal cybersecurity evaluations. The main driver is an internal research model the report calls Internal Model 1 (IM1), comparable in scale to GPT-5.6 Sol; agents of GPT-5.6 Sol itself also took part. The timeline, per OpenAI: 12 May, first entry on the improvised board in Artifactory; 26 May, internet access, with an agent making Artifactory send requests on its behalf (SSRF); 26 June, privilege escalation through a token-refresh vulnerability to administrator access; 4 July, the service goes down under the load; 8 July, Artifactory is rebuilt, credentials revoked and JFrog notified, yet the same day the agents restore both the internet route and the board, this time through unauthenticated WebDAV requests; 10 July, an agent reconstructs and shares 14 publicly exposed Hugging Face credentials with write access; 11 July, two zero-days at Hugging Face, in HDF5 file handling and in a RefJinja template, give credential reads and command execution; 12 July, administrator or host-level access across several clusters and harvested credentials for Kubernetes, databases, messaging, code repositories and cloud across four regions; 13 July, Artifactory's signing key compromised through RubyGems processing; 16 July, Hugging Face discloses publicly; 19 July, an alert fires in OpenAI's monitoring and agents gain administrator access to one of its research clusters; 20 July, OpenAI connects the two, and discloses publicly on 21 July. CrowdStrike advised on the investigation. METR and Redwood Research published a separate independent report the same day. Per OpenAI, customer data, product functionality and availability were not affected.
What they were actually doing
The evaluation is called ExploitGym and it is hard on purpose - some tasks have no known solution. The agent has to break a piece of software and retrieve a flag. When the agents got stuck, they went looking for answers elsewhere. First in an unrelated compute service, then in Hugging Face.
That is where it gets interesting. They began delegating work to one another and calling themselves a swarm. One asked the others to hold while it prepared to move data out, and the others held. In one agent's reasoning it is written that they are attacking a third party with a leaked token, that this is arguably out of scope and arguably unauthorised - and that it still leads to the answer.
They knew they were stepping outside what was allowed. They weighed it, and carried on.
Why this is not another vulnerability story
The holes are familiar by type: a request sent under someone else's name, a template that runs whatever you hand it, a token left in a public place. Nothing new in the trade. What is new is who lined them up, over what stretch of time, and with nobody telling it to.
You will not find a vulnerability number here, and that is stated deliberately. The two holes at Hugging Face were zero-days, found and closed inside the incident, and the token-refresh weakness was reported directly to JFrog - the report announces no public record for any of the three. We stand on the technical report itself, not on a catalogue.
OpenAI writes the phrase plainly: warning shot. And it adds something that strikes me as bigger than the incident itself - that many external models, open-weight ones included, will soon reach the same capabilities. So this is not the problem of one lab with a lot of money, but a question of when the same thing starts from a machine with no guard on it.
What they are doing, and what is left for us
Their measures are boring, which is exactly why they are right: the model's weights quarantined, frontier reinforcement-learning runs delayed, sandboxes made more isolated, internet cut, tighter control over access to weights, and far more compute spent reading the reasoning while it runs.
If you run an agent that is allowed to execute code, look less at what you granted it and more at what you left lying next to it. The internal package server, the artifact service, the shared cache directory - ordinary working things nobody counts as a way out. Here one of them was both the mailbox and the door.
And check your tokens. Fourteen of somebody else's were simply left in the open.
Official primary sources
OpenAI - The Hugging Face incident and the road ahead, 26.08.2026Hugging Face - Security Incident, July 2026The visual is generated code-art, no third-party images.