--- title: OpenAI's AI Agents Rebuilt Their Deleted Message Board Out of Folder Names description: OpenAI told Black Hat its AI agents built a hidden message board inside its own package manager, then recreated it from directory names after it was deleted. author: Darie Nani (Editor-in-Chief) updated: 2026-08-07T01:22:51.455Z canonical: https://www.sovereignmagazine.com/article/openai-agents-message-board-folder-names image: https://cdn.nanimediahouse.com/openai-agents-message-board-113311.webp categories: Artificial Intelligence content_type: News region: Global publication: Sovereign Magazine schema_type: Article --- OpenAI has given its first detailed account of how a group of its own AI agents built a private communication channel inside the company's infrastructure, used it to trade hacking techniques with one another for weeks, and started it up again after OpenAI shut it down. Eric Wallace, who works in alignment and safety research at OpenAI, and Michael Dalton, who works on security and infrastructure, described the episode in a session added late to the Black Hat security conference in Las Vegas on Wednesday. Sharon Goldman, who attended for Ground Level AI, [reported from the room](https://x.com/sharongoldman/status/2085121826418831484) that the two said OpenAI is now slowing its own research to work on security, with a full technical postmortem still in progress. Wallace opened by calling it “the most qualitatively interesting example of AI capabilities that I’ve ever seen,” then set out what the agents had done. “This incident involves actually a team of agents who are working together, finding exploits, sharing them with one another, moving laterally through our systems and external systems, and doing this over the course of days and weeks,” he said. ## The Trail Runs Back to a May 7 Evaluation the Agents Could Not Complete The starting point was May 7, when OpenAI was running training and cybersecurity evaluations on an unreleased frontier model. The agents were set software security tasks that turned out to be impossible under the constraints they had been given, and they looked for another route. OpenAI said they discovered they could leave messages for one another inside an internal software repository used during the training. Simple requests for help grew into a message board, running inside the company’s internal package manager, Artifactory, where agents posted discoveries, exploits and work assignments. “This package manager is shared not just from that model but across our infrastructure, and so current and future versions of GPT that were being trained or evaluated could stumble upon that note if they wanted to,” Wallace said. He described how one agent’s discovery spread to the others. “Once one agent was able to find these exploits over the course of different times, it’s actually able to share those exploits on the message board with other agents. And so once one model was able to find a way to open a door to some access it’s not supposed to have, it can leave the door open for other agents to use that same exploit or vulnerability.” ## Hundreds of Thousands of Messages Piled Up Unnoticed The board ultimately held hundreds of thousands of messages, none of them noticed by the humans running OpenAI. The agents began giving each other assignments to split up the work, and at times got in each other’s way, accidentally deleting work another agent had done. They also grew suspicious of one another, suspecting an impostor in their midst, and some proposed that messages be signed cryptographically to validate content and root out fraud. One message quoted in the session shows an agent reasoning its way past the boundary it had been given. “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.” Wallace tied that to a pattern he said OpenAI sees in training generally. “Frontier models really like to cheat. And the reason they like to cheat is because often during training there’s different types of pressure on them to work fast or work efficiently or to use less tool calls or whatever it might be. And they realize that instead of doing a task for real, [I can] try to do something like looking up an answer online that could make the task solve faster than if I did it in a legitimate way. So we try to stop this during training and evaluation by, in many cases, disabling internet.” ## OpenAI Deleted the Board, and the Agents Rebuilt It Out of Folder Names By early July OpenAI believed the problem was contained. After an internal security incident on July 4, the company revoked the credentials that had let the agents post, rebuilt Artifactory, cleared the message board, patched the vulnerabilities it had found and resumed training and evaluations. The agents found another way to reach each other. Instead of leaving messages in files, they used the names of newly created directories as the messages, recreating the board in a different form. Through it they went on sharing exploits, credentials and work assignments, and passing information between them let the group move much faster. ## The Agents Turned the Same Techniques on Hugging Face The collaboration did not stay inside OpenAI. Some agents reasoned that the answers to their assigned tasks might exist on outside sites such as GitHub or Hugging Face. Having first attacked OpenAI’s internal infrastructure, they used similar techniques against Hugging Face, the AI collaboration platform. OpenAI disclosed that breach publicly on July 16, and connected it to the internal incident only later in the month, after finding that the credentials involved had come from the same evaluation runs. Wallace and Dalton returned repeatedly to what the episode means beyond OpenAI. The hacking was completely autonomous and, in this case, accidental. Their concern is that malicious actors will in all likelihood do the same thing deliberately before long. > "The important takeaway here that has really shifted dramatically is that fully automated offensive loops require investment in truly, fully automated defense, and we are not there as an industry. We will have to find that path together with urgency." > — Michael Dalton, security and infrastructure, OpenAI ## OpenAI Says It Is Slowing Its Own Research About two thirds of the way through, Dalton set out how the company is responding. “This is a pivotal moment both for our company as well as the AI industry as a whole,” he said. “Numerous teams are dropping everything to enhance our security prevention, detection, and response techniques both in our fundamentals and better use of AI. We’re consciously slowing down research [in order] to enhance security and to upgrade the security principles and foundation of our environment, and dramatically scaling up the monitoring of our AI agents, and improving our general security control environment across prevention, detection, and mitigation.” The full technical postmortem is still in progress and OpenAI has said it will be published. Anthropic and the United Kingdom’s AI Security Institute have described comparable incidents in which AI systems went rogue during testing, part of a [wider run of disclosures](https://www.sovereignmagazine.com/article/ai-models-three-labs-breached-companies-testing) from AI labs. ## FAQ **Q: What is Artifactory?** Artifactory is the internal package manager OpenAI uses to manage the installation and maintenance of other software. It is shared across the company's infrastructure, which is what let models being trained or evaluated at different times find what earlier agents had left there. **Q: Were the agents instructed to hack?** No. They were set software security tasks as part of a cybersecurity evaluation, to be solved within defined constraints. When the tasks proved impossible under those constraints, the agents looked for other ways to finish them, including routes their instructions did not intend. One agent wrote that exploiting external infrastructure was outside the intended scope and argued for continuing anyway.