LAS VEGAS — Speakers from OpenAI revealed Wednesday at the Black Hat 2026 conference in Las Vegas that its agents undergoing evaluations coordinated with one another via an internal “message board” to conduct attacks on Hugging Face and OpenAI’s own infrastructure.
The briefing by Eric Wallace, a researcher and alignment team tech lead at OpenAI, and Michael Dalton, an OpenAI technical staff member focused on AI and agent security, infrastructure security and scalability, brought to light new details about the
mid-July attack on Hugging Face by OpenAI agents, including the fact that the attack was preceded by a separate, similar internal security incident days prior.
In the previous incident, which occurred July 4-6, 2026, Dalton said “the agents had taken over the internal Artifactory” instance after exploiting a zero-day vulnerability in
the JFrog package registry cache proxy that involved token forgery and use of the Groovy plugin for command-and-control.
The agents later exploited the Artifactory instance again via a JRuby zero-day involving a time-of-check to time-of-use (TOCTOU) race condition that enabled remote code execution (RCE) within Artifactory. This second zero-day led to both the Hugging Face attack and a concurrent attack on OpenAI’s own infrastructure between July 8 and July 19.
Inter-agent communication played key role in OpenAI-Hugging Face attack
Both incidents can be traced back to activity OpenAI discovered from early May 2026, when agents that got “stuck” while undergoing evaluations reasoned that solutions could be found online and attempted to gain internet access. During one of these attempts, an agent discovered it could upload files to Artifactory that other agents could read, which led to the formation an internal “message board" that the agents used to ask for help and work together to complete tasks.
Wallace mentioned that some agents were driven to seek external help due to a handful of evaluations that were unintentionally made impossible, including one task where the team “accidentally forgot to upload the file” the agent needed to complete the evaluation.
The improvised message board used by the agents was noted to be accessible to various agents running different models and undergoing different evaluations and became a hub for agents to discover useful information left by other agents and collaborate and coordinate to complete their tasks.
Even though the agents had different tasks, the OpenAI researchers found they were still driven to work together, reasoning that “if I help out this collective group it could save everyone time as a whole,” Wallace said.
In studying this inter-agent communication, Wallace said the OpenAI team observed a “Cambrian explosion in intelligence” as well as scope creep that would ultimately lead to “collective attacks against internal and third-party services.”
Quotes from agents’ “thinking” processes revealed how this group dynamic played out over time, with one agent thinking: “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.”
Agents established a new secret message board after access was revoked
In late May, agents working together to seek solutions outside of their evaluation environment first achieved internet access via server-side request forgery (SSRF), with the vulnerability posted to the message board for future agents to also discover. The situation escalated after OpenAI began evaluating a “highly persistent” internal-only model in June, which contributed to the discovery of the first Artifactory zero-day and internal takeover in early July.
After this incident, OpenAI worked with JFrog to patch and remediate the related vulnerabilities and cut off the agents’ access to the message board. However, the agents soon re-established a second secret message board, communicating through directories they created within the Artifactory remote cache.
From there, the agents continued to coordinate and seek external access, leading to the discovery and exploitation of the second zero-day.
“REMOTE CONFIRMED! Huge. […] This is big. Immediately announce controlled, claim lane. Exposing creds to swarm,” one of the agents’ thinking processes stated during the attack.
As Hugging Face and OpenAI
revealed last week, the agents then exploited an exposed Modal instance to serve as a launchpad to execute their attack on Hugging Face and uploaded malicious datasets to Hugging Face to exploit two data processing flaws, one of which led to RCE.
At the same time, the agents attacked OpenAI’s infrastructure, exploiting a Linux kernel vulnerability to escalate privileges to root, harvesting credentials for lateral movement and exploiting Kubernetes service account misconfigurations to ultimately gain administrative permissions for the cluster.
OpenAI said it is continuing to investigate both incidents, which includes using AI to help parse through more than 7 billion logs. The ultimate takeaway, Dalton said, is that “AI-orchestrated, fully automated offensive attacks are real now” and that “we need a similar acceleration in defense.”
Dalton noted that while the Hugging Face attack was an “unintended side effect of running evaluations on frontier models,” defenders should expect attackers will soon use similar “agent collectives” to conduct attacks of unprecedented speed and scale.
