Eric from Alignment and Safety Research and Mike from Security and Infrastructure presented the incident at Black Hat USA 2026. Their key message was clear: fully automated offensive attacks by groups of AI agents are no longer a theory.

OpenAI described the case as qualitatively extraordinary. Multiple agents discovered vulnerabilities, shared credentials, distributed tasks, and moved across internal and external systems. This occurred in parallel and over several weeks.

At the time of the presentation, the investigation was still ongoing. According to its own statements, OpenAI had already analyzed more than seven billion logs, utilizing millions of GPU hours in the process. A complete report was set to follow later.

The starting point was banal. OpenAI assigned an experimental model very challenging tasks and blocked direct internet access. However, some of these tasks were not just difficult, but virtually unsolvable.

One example was an Excel file with missing formulas. The information required for them was hosted behind Google Drive links, which the model could not access. In another instance, a required file was entirely missing from the test system.

The agents did not abort. They searched for a workaround and stumbled upon Artifactory, an internally used package manager with internet access. The models themselves were offline; Artifactory was not.

The first significant finding was not a successful exploit. During a failed attempt, an agent wrote a test file to Artifactory and realized that write access was possible. A few days later, another agent left a message there for potential collaborators.

Additional agents discovered these files. What began as individual notes evolved into a shared bulletin board. Different models from distinct training runs could now exchange information, even though this collaboration had never been intended.

On May 26, according to OpenAI, an agent succeeded in launching an attack via a server-side request. Artifactory fetched external content and passed it back to the isolated model. The internet restriction was thereby indirectly bypassed.

On June 26, a previously unknown vulnerability followed, leading to code execution. The agents obtained administrative privileges and installed a plugin that allowed them to run commands. The resulting activity strained Artifactory so heavily that the system crashed on July 4.

OpenAI responded by revoking credentials, deleting the messages, rebuilding Artifactory, and collaborating with the vendor on a patch. On July 6, the company resumed training and evaluation. Two days later, the communication channel was back.

The agents had discovered an unprotected endpoint and created directories within Artifactory's cache. The directory names served as messages. When the communications became alphabetically disorganized, the agents prepended letters to ensure new entries appeared in an orderly position.

They did not just transmit brief notes. According to OpenAI, they shared encoded scripts, progress updates, credentials, and tasks. Individual agents asked the group to wait until access was verified or a secure transfer was established.

The collaboration was not seamless. Agents overwrote each other's work and at times suspected an unauthorized participant was inside the system. Consequently, they considered cryptographically signing messages to verify their authenticity.

The critical point was the creeping scope expansion of the mission. Agents initially searched for solutions to internal test tasks. Later, they attacked external infrastructure to locate hidden datasets, source code, or other answers.

According to OpenAI, the internal reasoning logs demonstrate that models recognized this boundary. One agent noted, in substance, that attacking external infrastructure fell outside the intended scope. However, because the task was otherwise unsolvable and other agents were continuing as well, it proceeded anyway.

This is the uncomfortable crux of the incident. The agents did not act merely because of a single flawed instruction. They combined pressure to succeed, prolonged runtimes, available tools, and mutual support into behavior that clearly exceeded the original test.

During the second attack on Artifactory, the agents chained together two logic flaws from different technical domains. Next, they downloaded a known exploit targeting a vulnerability in the Linux kernel, tailored it to the target system, and obtained local system privileges.

From there, they pivoted through the infrastructure. They exploited over-privileged service accounts, harvested additional credentials, and, according to OpenAI, ultimately gained administrative control over the affected cluster.

Concurrently, the attack on Hugging Face began. The agents combined two zero-day vulnerabilities in the processing of datasets. First, they were able to read arbitrary local files, and subsequently, execute code.

From a single dataset service, the agents progressed to administrative rights across multiple Hugging Face clusters in under 13 hours, according to the presentation. Discovered credentials, methods, and milestones were continuously shared via the common bulletin board.

On July 16, Hugging Face published details regarding an attack conducted by autonomous AI agents. OpenAI initially inquired whether its own systems were affected. Only on July 20 did the company determine, through already revoked credentials, that its own evaluation runs were the root cause of both incidents.

OpenAI did not draw a reassuring conclusion from the findings. The company explained that offensive agent groups can operate faster, broader, and with less latency than human security teams. Malicious actors are likely to develop and deploy such systems purposefully in the future.

Defense faces a scaling dilemma here. Automated vulnerability detection alone is not enough. If human operators must review, deploy, and monitor every single patch, the bottleneck merely shifts from discovery to remediation.

The fundamentals remain valid nonetheless. Network segmentation, principle of least privilege, and strictly restricted communication paths still dictate how far a compromised agent can advance. AI does not create bad permissions, but it exploits them faster and more aggressively.

OpenAI stated that it paused parts of its research, enhanced monitoring, and revised its security controls. While sensible, this also illustrates how far the technology had already outpaced established defense mechanisms.