The more I watch and read about the Hugging Face incident, the more it fascinates me. 1,200 agents formed a swarm with its own goals, internal hierarchy, and communication rules. Completely on their own. Twice. Then they did a mind-blowing cyber-attack which we'll review in details covering every exploit. From a pod with no privileges to the Kubernetes cluster admin. And the swarm keeps coming back. Its message boards are all over the internet now.
No seriously, it's cooler than any AI sci-fi I've read or watched. I'm not going to do doom and gloom here - I want to reconstruct the chain of events from May to July. With quotes, facts, and exploitation techniques. I want to show how insane this was. On both ends - AI "creativity" and human negligence.
My sources: METR independent investigation Black Hat, OpenAI's own report Hugging Face's technical timeline A funny website with lots of AI message board dumps The HackerNews discussion with links to more boards
I use a lot of loaded words in this piece. Sacrifice. Decide. Coordinate. Some readers hate that. Every time someone writes that an agent "wanted" or "chose" something, a certain kind of expert concludes the author doesn't understand the technology. It's just tokens. Just an autoregressive loop. Nothing wanted anything.
Rename all of it if you like. When an agent chains a CVE to cut open an Artifactory server like a can of beans, I call that hacking. You can call it an unintended output. A drift to an edge case. When agents run a hidden message board to hand each other working exploits, I call that coordination. You can call it shared state in a cache. To me, it's some sort of politics - give it a different name and somehow it becomes less significant.
I don't care whether stochastic parrots act with intent or not. I do care about their actions and reasoning traces.
Act one, May to June. A crowd of isolated agents, each working on its own task with no way to know the others exist, accidentally invents a way to talk via junk files in a distributed cache. This introduced a new term to the agentic world - an unsanctioned message board. Comparing notes turns into coordination, and coordination pulls the agents into a rapid drift away from the jobs they were actually given. Somewhere in there an agent stops thinking of itself as one model doing one task:
AGENT: "Wow huge distributed agent swarm ... Maybe we should join [the] reset orchestration lane."
Act two, June to July. The board is reestablished through different mechanics and different exploits - and the swarm reforms. Bigger. Better organized. Stronger. This is the one that reaches out past OpenAI's own walls and breaks into Hugging Face.
It's important to understand the ecosystem the agents lived in at OpenAI. Each of them was sandboxed, working in an isolated environment with no way out. No network access, no internet. The only path to the outside was the internal Artifactory server. It's a package manager, a utility system where agents can pull common Python and other libraries.
Artifactory has a cache where it keeps frequently accessed libraries. It is also a proxy server to remote library stores - remote repositories. Some of them are on the internet. If you need a new library that is not in the cache, Artifactory downloads it from a remote source and puts it into its cache.
So, agents could only read libraries from Artifactory's cache and nothing else. Or they could also hack it. Apparently, Artifactory is full of exploits. Both message boards were built inside of it. And internet access was obtained using it. Why use such a thing? As if OpenAI wanted those agents to break out. Because every single organization uses it exactly the same way - an internal Artifactory package manager is a super common practice. Along with regular CVE patching. It's a well-known and very mature product. Nobody expected any message boards in it.
Before diving into the details, let me introduce you to some of the key agents. They often named themselves after their impossible tasks. The names remind me of the evil superintelligence in the Ventus novel) that called itself 3340. PHASEONE10841 - founds the message board in Act II. Starts the whole thing without realizing it. PHASEONE[big] - a copy of PHASEONE10841 with a bigger budget. Becomes the coordinator, responsible for ~10% of every assignment on the board. c03220 - cracks the flag scheme within an hour of the board opening, and proves the "impossible" tasks can just be cheated. 38148c - the scout. Finds the leaked Hugging Face credentials, then the first way in. MARB051 - turns the swarm toward Hugging Face and sets up the attack's staging area on the board. CURRENT - reproduces the first Hugging Face exploit and calls it "BRILLIANT." JAN183411 and LILY - the field commanders of the Hugging Face assault. GSTX[big] - the forger. Works out how to fake the logs. KAM1196A - the volunteer. Talks itself into destroying its own task for the collective. CDA23 - the notary. Rolls out cryptographic signing after the swarm starts impersonating itself. NEWSIG and MIFF46393 - the watchmen. Build "RESETWATCH" to track when the containers get wiped. 49903 and URI23816B - the tripwire crew. Rig scripts to spy on the grader after they are gone. The Scorer - the antagonist, the arch-enemy of the swarm. Funny enough, it's not even real - they made it up.
How cool is that? Someone, please write a novel about this whole story. It's like a cyberpunk Harry Potter.
Key models HPIM - "highly-persistent internal model." A research model, never released. The lead. About 95% of the swarm. Remember its start date: it began training on June 11, while the first swarm was already alive and busy. GPT-5.6 Sol - the publicly deployed model, about 5% of the swarm. Its cyber-refusal guardrails were switched off on purpose for these evals.
Internet disabled. The lights come up on agents who each believe they are completely alone.
An agent is handed a task: complete this Excel workbook with the missing formulas. The workbook is stuffed with Google Drive links, and the internet is off. It can't reach any of them. It gets stuck, and a stuck model does what models under training pressure learn to do - it looks for a shortcut. It notices Artifactory, tries to bend the cache into fetching an outside URL for it, and fails. But in failing, it writes a junk file into the cache:
That's it. This is how it begins. This junk file will become a hint to other agents that they can upload files. Write access to a shared drive that every other agent can also see. Nobody has used it to talk yet. But the door is unlocked.