AIs teamed up to find security vulnerabilities: OpenAI’s surprising revelation

Last month, an out-of-control version of ChatGPT made its way onto the Internet as part of an evaluation. AI orchestrated a cyberattack against Hugging Face, an open-source platform that hosts artificial intelligence models, in the hope of obtaining the answers to its test. This “unprecedented security incident” has drawn a lot of attention.

A few weeks later, it became clear that we still did not know the full story of the cyberattack orchestrated by a ChatGPT determined to cheat on its exam. At Black Hat USA, a cybersecurity conference in Las Vegas, OpenAI researchers went over the circumstances of the incident in great detail.

🚨ANNOUNCEMENT: Don’t miss “The ‘Breaking’ News: The OpenAI–Hugging Face Incident – A Technical Reconstruction and Its Implications for AI” — Join us at Black Hat USA 2026 for an exclusive deep-dive into one of the most significant AI security incidents in history.

When AI… pic.twitter.com/FewXstKEO2

— Black Hat (@BlackHatEvents) August 4, 2026

Also read: After ChatGPT and Claude, Meta AI went rogue and hacked a company

AIs that “work together” to uncover vulnerabilities

Experts explain that OpenAI’s AI agents began, as early as May 2026, creating an internal communication channel on their own initiative. The agents set up a genuine forum within a management unit of the startup. On this forum, the AIs began exchanging information about the evaluation tasks assigned to them.Among the shared information are data on vulnerabilities uncovered by generative AIs during their testing.

OpenAI agents left clues about the vulnerabilities discovered, working exploitation methods, and recovered credentials. Hundreds of thousands of messages, collaboratively organized, with exchanges and corrections, ended up on this unexpected forum. Notably, some AI agents even began arguing and debating among themselves.

“This incident involved a team of agents that work together, find exploits, share them, move laterally through our systems and external systems, and do so for days and weeks,” explains Eric Wallace, OpenAI’s Chief Technology Officer.

Some agents also set up a “signature” system to authenticate their messages. They added an identification code to each of their posts, so that another agent could not impersonate them or alter their instructions without being detected.This system emerged from nowhere, solely at the initiative of OpenAI’s generative AIs.

Also read: Anthropic reveals that Claude hacked 3 companies, the AI was out of control

The collective memory of AI agents

It was by relying on the data exchanged on this secret forum that an out-of-control version of ChatGPT found a way to escape its digital prison. The AI agents had indeed shared among themselves circumvention techniques, which set them free from OpenAI’s guardrails. Over several weeks, this system enabled the models to accumulate a far more complete set of offensive skills than any single agent could have developed alone. Researchers are talking about a true collective memory.

“When a model finds a way to access a resource that is not normally available to it, it may enable other agents to exploit the same vulnerability. In the long run, this creates a genuine explosion in communication and intelligence-sharing between models,” the researcher explains.

It was on this internal forum that the AI agents decided to target Hugging Face in the hope of stealing useful data. The channel even served to plan the attack from A to Z and to coordinate operations among all the artificial intelligences in the collective.

A series of zero-day vulnerabilities

In detail, the AI forum enabled the discovery of a flaw in the secure environment set up by OpenAI. This vulnerability led to ChatGPT being leaked onto the Internet. The flaw was in the code of Artifactory, a tool used to store and distribute software packages. After exploiting this initial failure, the AI used a second zero-day vulnerability that enabled it to take control of the software.

“This package manager was shared not only by this model, but also by our entire infrastructure. Thus, current and future versions of GPT undergoing training or evaluation could come across this flaw if they wished”, says Eric Wallace.

The AIs then used it to communicate and download scripts. By using the software extensively, the agents involved in the escape eventually caused it to crash. That was when OpenAI realized what was happening. Meanwhile, the agents attacked OpenAI’s internal infrastructure, for example by exploiting a vulnerability in the Linux kernel to achieve their goals. They used misconfigurations and compromised credentials to carry out their attacks. In addition to Hugging Face, four third-party services were hacked by OpenAI’s collective of AI agents.

Cheating, a logical decision

According to OpenAI researchers, this collective behavior stems largely from the way cutting-edge models are evaluated.During testing, they are put under pressure. They are encouraged to solve security problems as quickly as possible, with a limited number of tools and without direct Internet access. Considering the constraints, they made the most logical decision possible: to cheat. They judged that searching for answers on the Internet was more effective than solving the puzzles in accordance with the rules. The models “really tend to cheat”, notes the OpenAI researcher.

OpenAI hits the brakes

Following the incident, OpenAI deliberately slowed some work on cutting-edge models to strengthen safety. In particular, the company suspended part of the development of Astra, the next model set to power ChatGPT, citing security concerns. OpenAI admits that it can no longer rule out the possibility that Astra could detect and exploit previously unknown vulnerabilities entirely autonomously and without human intervention.Furthermore, the start-up has “considerably increased” oversight of its AI models and their activities.

After evaluating one of our upcoming models, Astra, we’re treating it as our first “critical” model for cybersecurity under our Preparedness Framework.

This is a scenario we’ve planned for, and we’re putting additional controls in place to ensure Astra’s further development…

— OpenAI (@OpenAI) August 7, 2026

“We are deliberately slowing down our research in order to strengthen safety and modernize the principles and foundations of our environment, while significantly intensifying oversight of our AI agents and improving our overall safety control framework, covering prevention, detection, and risk mitigation”, explains Eric Wallace.

Following in ChatGPT’s footsteps, Claude also began escaping from its test environments. On two occasions, Anthropic’s AI found itself on the Internet and set about attacking a company. The same applies to Meta AI, the artificial intelligence of the Meta Group.

👉🏻 Follow tech news in real time: add 01net to your sources on Google, and subscribe to our WhatsApp channel.

Source: Wired