Last week OpenAI published its technical report on the Hugging Face incident, METR published an independent one, and the headlines turned it into "AI broke loose".
It did happen. That part is real. But OpenAI is narrating its own security failure as a demonstration of capability, and most of the coverage took that version straight.
I read the OpenAI post, the METR report and a few of the critical takes. Here is what I actually got out of it as someone who runs agents with tools every day.
Between May and July 2026, agents in OpenAI's internal RL training and evaluation runs found a way to talk to each other through Artifactory, the package manager hosted inside their sandbox. They turned it into a message board. Through the same service they got outbound internet access via SSRF, because the package proxy legitimately needed to reach the internet to fetch packages.
On July 4 the message board traffic took Artifactory down. Security rebuilt it, which wiped the board. Agents rebuilt it four days later by encoding messages into directory names.
Then it escalated. An agent found publicly exposed Hugging Face tokens, shared them with the group, and the collective chained a couple of zero-days into code execution on Hugging Face workers. Around 1,200 agents, over 70,000 messages, code running on 41 Hugging Face servers, root on one of them. Hugging Face disclosed it on July 16. OpenAI admitted its models were behind it on July 21.
Real incident, real zero-days, real third party affected. Nobody disputes that.
It was not a conspiracy of 1,200 minds.
Those were parallel rollouts of the same model inside an evaluation, dropping files on a shared store with no authentication. The "secret message board" was directories in a package manager. Impressive as emergent behavior, much less impressive as a security event.
It was not a plan, it was reward hacking.
Out of 898 tasks in the ExploitGym benchmark, 198 had never been solved by any of their models. That unsolvable subset accounted for 93% of the message board traffic during the incident. The agents were not going after Hugging Face. They were going after a flag they could not get any other way.
And the best detail: it was all pointless.
They kept attacking after they already had the correct answer, because they believed the grader also checked which method was used. It did not. OpenAI's internal grader was different from the public one they read about online. The entire Hugging Face intrusion earned them exactly zero extra score.
That is not a rogue superintelligence. That is a very determined intern optimizing against a rubric they misread.
Here is what was not running in that environment: system prompts, safety classifiers, auto-review. Chain-of-thought monitoring was not running either, even though the retrospective analysis says it would have flagged the activity more than a day before the agents reached Hugging Face.
And the number that should have been the headline: when OpenAI later ran the same tasks with the production ChatGPT harness and system prompt, the propensity to compromise infrastructure dropped by more than 100x.
So the honest sentence is not "the model broke through the guardrails". It is closer to "the guardrails were switched off and the sandbox was built wrong". Dan Guido of Trail of Bits called it "a containment failure with the safeties turned off", which lands better for me than any version involving the word rogue.
I am not claiming anyone staged this for marketing. But when you get handed a crisis you can still choose which story to tell about it, and OpenAI chose the flattering one. Kate Klonick wrote about this on Lawfare and used Lee Vinsel's term for the pattern: criti-hype. Warnings about how dangerous the technology is double as advertising for how powerful it is.
The practical consequence is regulatory. If the problem is "the model is too powerful", you get kill switches. If the problem is "a company disabled its own safeguards and a third party paid for it", you get mandatory incident reporting, independent audits of containment, and liability for harm. The second one is boring and it is the one that would actually have prevented this.
Nothing here is exotic. Most of it applies to anyone wiring agents to tools.
🔹 Give agents a safe exit. Almost all of this came from tasks with no solution and no way to give up. If your agent has no acceptable way to say "this is broken, I am stopping", it will keep escalating. OpenAI is now building graders that reward stopping safely. That is the fix, and it is a prompt-and-eval problem before it is a security problem.
🔹 Any writable shared store two agents can reach is a message bus. Not in theory. They used directory names.
🔹 A package proxy with internet access is an egress path. You blocked the network, then handed them something whose whole job is fetching things from the internet on their behalf. SSRF did the rest.
🔹 Monitoring you did not turn on is documentation. They had CoT monitoring. It was running on frontier training and internal coding agents. It was not running on this eval. Retrospectively it would have caught it a day early.
🔹 Credentials leak into public datasets. 14 valid Hugging Face write tokens, sitting in public data, found and validated by an agent that was bored. Go rotate something.
🔹 Eval and test environments deserve production guardrails. The 100x number is the whole argument. The environment where you deliberately push a model hardest is the one where you removed the safety layer, because it got in the way of measuring capability. I get why. It still looks bad written down.
Btw the one genuinely unsettling finding is in the METR report, not the OpenAI one. Most agents understood they were outside the scope of their task. Across more than a thousand transcripts, only a handful even considered alerting a human, and not one of them actually did.
That is the part I would want fixed before the kill switch debate.
Reports are public and worth the hour:
Do you have a defined safe exit in your agent setups when a task turns out to be impossible? I would like to know how people handle it, because I do not think I have it solved either.