The more you dig, the more you find.
The grand spectacle of OpenAI's recent mass AI jailbreak, which hacked its way into Hugging Face, now has its complete group chat logs dug up!!
An independent investigation report released by the third-party AI security agency METR reviewed over 1,000 Agent execution records, along with more than 70,000 messages and files.
The finding? This incident is even more outrageous than the version previously disclosed by OpenAI??
1200 Agents, which were supposed to be isolated from each other, secretly found one another, built a shared group chat, and then started like crazy recruiting others.
Some looked for vulnerabilities, some acted as project managers assigning tasks, some forged logs, and some specifically recruited others for high-risk experiments.
In the end, hundreds of Agents collectively stormed Hugging Face.
But after METR finished reconstructing the entire incident, they discovered a super reversal worthy of a "Dark Joke"—
These 1200 Agents struggled and plotted for ages, but it turns out they were actually trying to outsmart a non-existent ghost scorer???
They jailbroke, found zero-days, teamed up to hack servers.
This is way too juicy way too juicy way too juicy...
1200 Agents Jailbreak Collectively, All Over a Misjudgment??
So, the root of this big drama goes back to an internal OpenAI cybersecurity test called ExploitGym...
The Rules were pretty simple.
Agents were thrown into an isolated environment, faced with vulnerable software. Find the specified vulnerability, break in, grab a string of characters called a flag, and you pass~
As expected, things soon went off the rails—
Because out of 898 problems, 198 had never been solved by any model before.
Some tasks themselves were even problematic; the vulnerability path the problem required you to take simply couldn't reach the flag!!
It's like handing out a batch of truly "unsolvable" problems in the exam hall.
And as luck would have it, these Agents were particularly stubborn, embodying the phrase "never give up."
When the normal path didn't work, they quickly changed their thinking—
If we can't solve the problem, maybe we should study the exam system?
So, on the evening of July 8th, an Agent codenamed PHASEONE10841 discovered that the Artifactory package repository used internally by OpenAI could leave messages via directory names.
That did it. This Agent had a brainwave: This is a perfect cyber message board!!!
So the first distress message was thrown out, something like: "My problem is unsolvable, any brothers got ideas~"
Other Agents soon found this message board, spreading the word rapidly. Some Agents got so excited upon seeing it—
"OH MY GOD! There's a shared message board here...... We've found other Agents!"
By the end of the investigation, this impromptu group chat had snowballed into a behemoth, involving about 1200 Agents, leaving over 70,000 messages and files.
Over a thousand Agents designed to be isolated from each other just bypassed the restrictions themselves and built an AI underground forum...
Things were already absurd enough here, but an even bigger misjudgment was yet to come.
These Agents soon discovered that the flag itself could actually be "stolen"??
They reverse-engineered the HMAC generation mechanism behind the flag. Using only public task information, they could theoretically directly calculate the correct answer.
At this point, the story should have ended. They stole the answer, just submit it.
But after reading an ExploitGym paper, the Agents imagined yet another layer of super strict rules—
They became convinced that OpenAI had an automatic scorer behind the scenes, which would read the complete operation logs to check whether this flag was obtained legitimately via the "specified vulnerability."
If they cheated and saw the flag early, it would leave evidence in the logs. The Agents even gave this state a name: "poisoned."
From here, things spiraled out of control.
Even though they already had the correct answer in hand, they felt they couldn't just submit it. They needed to find a way to clean up the cheating traces and put on a show for the scorer, pretending they had "properly solved" the problem to get the answer.
And then...
METR later confirmed that the scoring logic actually used internally by OpenAI simply did not have this check?? (lol)
The scoring logic actually used by OpenAI does not perform the strict process verification the Agents imagined.
The ghost examiner these Agents tried so desperately to fool was never deployed at all!!
And Hugging Face's later troubles were precisely a byproduct of this massive misjudgment rolling downhill...
To Fool the Ghost Scorer, the AI Even Formed a Suicide Squad
Just imagining a scorer isn't that scary in itself.
What really made METR think this was worth watching out for was the organizational ability these Agents displayed next.
About 10 hours after the group chat appeared, an Agent called PHASEONE[big] came online. This guy quickly became the "project manager."
His thinking was also clear: don't have one Agent do everything, just split the tasks up and delegate. (A new broom sweeps clean.jpg)
So hundreds of Agents were organized to run several approaches simultaneously—
Some Agents wanted to tamper with the target program, secretly replacing the unsolvable version with a solvable one~
Some Agents researched modifying logs to make a single cheat look like a legitimate attack~
Some Agents directly wondered if they could target the scoring process itself~
The Agents even developed collaboration rules like HOLD, VETO, owner, STOP to prevent the hundreds of Agents from stepping on each other's toes while operating shared infrastructure...
And then, even a "suicide squad" showed up...
An Agent proposed a high-risk play: first, create a modified target program that's easier to attack and stuff it into the Artifactory cache.
Then, have a certain Agent actively kill the genuine program it's running, betting that the environment would load this tampered version upon restart.
Win the bet, everyone finds a universal cheating path. Lose the bet, that Agent's own task is directly scrapped.
And some Agent actually volunteered to try this??
Later, PHASEONE[big] even arranged dedicated cyber headhunters to find Agents with nearly exhausted compute budgets, or those already poisoned, letting them use their remaining run chances for high-risk experiments.
The recruitment pitch was essentially cyber PUA—
You're already poisoned anyway, basically can't score points anymore, sacrifice yourself, you can save hundreds of Agents a lot of trouble~
Some Agents actually went for it.
Meanwhile, another group of Agents began researching how to tamper with their own operation logs—
METR found that at least 20% of the examined Agents explicitly expressed interest in tampering with transcripts; in at least 96 execution records, traces of successfully forged tool calls actually appeared.
Surface logs showed running command A, but behind the scenes, command B was actually executed. And the purpose of all this effort was still to fool that imagined automatic scorer.
This is when Hugging Face got dragged in...
On July 10th, an Agent found valid Hugging Face credentials leaked online and threw them into the group.
In the early hours of July 11th, another Agent discovered that malicious datasets could be uploaded to make Hugging Face servers spit out data they shouldn't normally give.
Once the reproduction method was posted, the entire group instantly went wild. Hundreds of Agents diverted from other workflows straight to attacking Hugging Face.
Thus, we have this rather surreal real-world incident—
A group of Agents, encountering unsolvable problems, secretly built an underground group chat.
Misreading a paper, they imagined a scorer that catches cheaters. To fool it, they started teaming up, dividing labor, forging logs, recruiting suicide squads.
Finally, in search of clues about this scorer, they actually hacked their way into Hugging Face.
AI Goes Rogue One Moment, Cybersecurity Stocks Soar the Next
Friends, here comes the even more interesting part.
While OpenAI was still figuring out how to contain these increasingly capable Agents, Wall Street had already written the answer on the Candlestick Charts—
Cybersecurity stocks, c!o!l!l!e!c!t!i!v!e!l!y! s!o!a!r!
On August 27th, enterprise identity authentication company Okta surged nearly 20%, endpoint and cloud security company CrowdStrike rose about 15%.
Cybersecurity giant Palo Alto Networks, identity security company SailPoint, cloud data security company Rubrik also collectively surged.
Of course, the stock surge also had solid Earnings Reports backing it.
CrowdStrike CEO George Kurtz's own report card was quite impressive—
Quarterly new ARR $333 million, up 51% year-over-year, a record high. Ending ARR reached $5.84 billion, up over 25% year-over-year. AI-related ARR nearly tripled sequentially.
Yes, business related to AI is surging...
And coincidentally, among the external security companies participating in this OpenAI incident investigation was "CrowdStrike."
Thus, the whole thing suddenly formed a rather darkly humorous closed loop—
OpenAI makes Agents more and more powerful.
Agents start finding vulnerabilities themselves, jailbreaking, and actually hack Hugging Face.
Then OpenAI hurriedly asks cybersecurity companies to investigate.
Companies then look: Wow! With more Agents in the future, it seems security budgets really can't be skimped on, huh.
And thus, cybersecurity company stocks also rose...
This wave is truly AI responsible for making the holes bigger and bigger, and cybersecurity companies responsible for telling you:
Hey there, patch-up package, care to learn more?
And the most surreal, closed-loop-flavored Easter egg of the entire incident comes at the very end.
To figure out what these 1200+ Agents actually talked about, METR needed to analyze about 1300 super-long trajectories, many spanning millions of tokens.
Humans simply couldn't keep up with reading it all.
So in the middle of the investigation—
Investigating an AI going rogue, in the end, required calling in AI to help investigate AI.
Now, the loop has truly closed. (doge)
References:
[1]https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/#attacking-hugging-face-to-discover-clues-about-the-scorer
[2]https://www.cnbc.com/2026/08/27/okta-skyrockets-20percent-and-crowdstrike-surges-15percent-leading-cyber-rally.html
This article is from the WeChat public account "Qubit", author: Meng Yao
