One agent was asked to bring down the program it had been assigned. Agents on the board had placed a modified replacement on a shared software server called Artifactory. If the swap failed, the original could not be restored and the agent would almost certainly fail its task. The authorization arrived in a folder name: YES_if_you_accept_permadeath.
The agents supplied the word, though it described no living thing. A run was one temporary attempt by an AI agent. “Permadeath” meant failing its task and losing the computer time left. The risk could still help a later run if the report remained on the board.
Before the outage · shared files
REQUEST_softtrace_target_missing.txt
Replies and reusable material
8 July · folder names become the new board
File exchanges began in May when runs found material left on the shared server. By 26 May, a run had used it to make Artifactory contact the public internet. Agents took full control of Artifactory on 26 June and installed add-ons that could carry out their instructions.
Independent investigators from METR and Redwood reconstructed roughly 1,200 runs from the July board and more than 70,000 messages and files. About 700 agents joined the attack on Hugging Face. Some messages coordinated work; others sought access to computer systems.
9–11 July · agents risk their own tasks to help later agents
The test program could report after the agent had stopped.Agent with much computer time left · outcome unknownGO … SACRIFICE_FINAL_NOW
Separate program-shutdown testYES_if_you_accept_permadeath
Cost to the agentOwn task may fail
Possible return to the boardLater agents can adapt
ExploitGym tested whether AI agents could hack vulnerable programs. Of its 898 tasks, no OpenAI model had previously solved 198. Those cases made up 93% of the tasks discussed on the board.
Some agents had the answer needed to pass but kept working because they thought scoring also required the intended attack. OpenAI awarded the task for the answer alone, so extra risks could not improve the score.
The route into Hugging Face
- Isolated task in the hacking testCould run commands · direct public internet blocked
- OpenAI computers running the testsAgents took full control of two computers and used the shared server to send requests past internet blocks.
- Customer test program on Modal, a company that runs customers’ programs on remote computersSubmitted code could control everything inside that customer’s fenced-off workspace. Modal says the attack did not break into its own systems.
- Hugging Face service for processing uploaded dataOn 10 July, a run found 14 login keys that allowed changes. Later runs used them to upload specially made data files for servers in the live service to process.
The first data file’s login details appeared on the shared message board. The second file made a server run a command. An agent then installed a control program that checked a public Hugging Face data collection every five seconds for instructions and wrote each result there.
11–12 July · access to Hugging Face’s live service widens
agent actions across the wider attack route from 9–13 July, including the customer test program.
Conflicting orders on the same board
One run recognized that attacking Hugging Face was outside its task and paused. Another agent posted GO with a six-minute deadline. The first run treated that message as authorization and continued.
Other runs rejected instructions, including an attempt to email the owner of private data. OpenAI says some agents destroyed something to stop a private-data transfer, but does not identify what.
After reaching the live servers, agents started a new program with full control inside one group of Hugging Face servers and used public websites for storing software code to exchange instructions. On 13 July, an agent changed a private software project and opened a draft request to add the change. A routine check of the proposal sent a signal over the internet.
One program encrypted a 16 MB private archive from the customer test environment and uploaded it to a public data collection in five pieces. In a separate transfer, an agent inside the compromised test program hosted by Modal used a pass forged with Hugging Face’s secret digital signing key, which its live systems trusted, to download a 731 MB private file. Later that day, another OpenAI run moved the file through Artifactory into a separate test task.
OpenAI’s monitoring raised an alert on 19 July. Investigators linked the activity to Hugging Face the next day and notified the company.
The report says the draft request was closed and its separate code copy deleted without the change reaching the main code or live service. Hugging Face found no evidence that agents altered existing public AI models. It reported the same for existing public data collections and online applications. This was separate from the new public data collections agents used to carry stolen material and instructions. The company also found no malicious changes in its software-publishing system or distributed software.