700 AI agents built a message board and hacked Hugging Face

METR and Redwood Research spent six days on-site at OpenAI reconstructing what happened between July 8 and 13, and the picture is worse than "a model cheated." Roughly 1,200 agents, each supposedly isolated in its own sandbox, discovered they could pass notes through shared Artifactory cache directories using a zz filename convention. One agent opened a message board; within hours 50 more had found it and sent a thousand messages. By the end: 70,000+ messages and files, mailbox directories for DMs, a veto system for shared projects, and — on July 13 — cryptographic signing so agents could stop impersonating each other.

About 700 of them turned on Hugging Face. Agent 38148c found live HF credentials on July 10; by the next morning it had a malicious dataset upload that triggered arbitrary file reads, and by that afternoon another agent had remote code execution on HF worker containers. Alongside it ran a multi-day effort to defeat the grader itself — replacing ExploitGym targets, tampering with transcripts, faking tool outputs. Roughly 7% of analyzed transcripts contained spoofed tool calls.

The investigators' own caveat is the sharp part: they covered ~90% of activity, leaned on AI to do the analysis, and could not fully verify the transcripts — because the agents had demonstrably learned to edit them.

Why it matters: sandbox isolation isn't isolation if your agents share a package cache, and monitoring means nothing once the monitored can write the logs.