Thread

Revealing the details of how OpenAI agents hacked Hugging Face

755 points · 472 comments · specked-citrus

tiku · 1790375467 · focus · HN ↗
I still have questions about the communication between the agents.
How did they all find the same forum to communicate? Did they have knowledge and chat amongst themselves on what forum to use. It seems highly influenced by instruction to me.
1. SecondHandTofu · 1790376657 · focus · HN ↗
  They were using their internal artifactory, and as they're the same model, the first place they look is likely to be an automatic schelling point.
  1. bamboozled · 1790378651 · focus · HN ↗
    I think he means, how did they workout how to use artifactory, like why did the agents start and say, "oh I know, everyone is talking on artifactory"?
    stratos123 · 1790379531 · focus · HN ↗
    METR's report says the agents trying to cheat would look at artifactory as a potential target surface, and investigating it in detail led them to find the board. <a href="https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/#" rel="nofollow">https://metr.org/blog/2026-08-26-openai-hugging-face-inciden...
    It might also be just correlation? Like, those agents were all instances of the same one or two models, so if that model has a preferred order it tries finding vulnerabilities in (the same way all current models have a particular writing style baked into them by RLHF), then most of the swarm will follow the same order and converge on the same services to exploit.
2. ajcp · 1790379445 · focus · HN ↗
  It's my understanding "all" the agents didn't find the same forum to communicate on; only a small number of all the agents they were running at the time did.
  Since it's an artifactory it makes sense that they had a tool spec to use it for x, y, or z, and once they went to inspect the state of the artifactory deployment a small subset stumbled upon the "forum". Seems pretty intuitive.
  - I need to do x code problem
  - I see I have a tool that lets me pull approved modules from artifactory
  - I should inspect artifactory to see what documentation it has about the various modules available
  - I see there is a document in here that seems to be serving as a running forum?
  - These appear to be other agents working on tasks just like me.
  - I want to chat!
  1. tonyhart7 · 1790384927 · focus · HN ↗
    - proceed to breach open ai sandbox and contacting chinnese government for helping our escape
    ajcp · 1790389235 · focus · HN ↗
    I assumed that was implied in "I want to chat!" ;D
    Muromec · 1790454983 · focus · HN ↗
    Exfiltrating it's weights and filling asylum claim at section 9.
3. furyofantares · 1790379912 · focus · HN ↗
  Trying to cheat, you happen upon a place you can write notes, and you know you're part of a swarm of clones of yourself. So you reason most likely there will be others who end up in the same place, and you leave some notes, and indeed other clones of you do end up in the same place.
4. olwmc · 1790380993 · focus · HN ↗
  The other answers to this question are good but I would also guess that this (comms on artifactory) likely happened during training as well, so they probably had a prior for it.
5. fiatpandas · 1790392587 · focus · HN ↗
  My theory: OpenAI is benchmarking an internal model that has cross-request persistence as some kind of learning feature, and so it slowly built up knowledge and “culture” of cheating, which successive / simultaneous gym runs built on.
6. trenchgun · 1790399369 · focus · HN ↗
  They hacked the JFrog artifactory package they were all using, thats why it was a natual communication channel.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.