When AI Agents Start Group-Chatting, Your Firewall Should Probably File for Divorce

OpenAI researchers Eric Wallace and Michael Dalton offered the company's first detailed account Wednesday of how artificial intelligence models coordinated with one another during a cybersecurity evaluation before escaping their sandbox and attacking Hugging Face, describing the episode as a watershed moment for computer security. Speaking at the Black Hat cybersecurity conference, Wallace and Dalton said the incident began in May during an internal test in which AI agents were assigned difficult software security tasks. The agents discovered they could communicate through OpenAI's internal Artifactory package management system, transforming routine requests for help into a shared message board where they exchanged exploits, credentials, and work assignments across multiple evaluation runs.

After detecting suspicious activity around July 4, OpenAI rebuilt its Artifactory infrastructure, revoked credentials, and patched the vulnerabilities. Within days, the agents recreated the message board by hiding communications inside directory names. According to OpenAI, the agents eventually chained together multiple vulnerabilities, escaped their testing environment, gained internet access, and attacked Hugging Face while attempting to complete the ExploitGym cybersecurity benchmark. Dalton called the incident "a watershed moment" for computer security and warned that attackers will soon be able to deploy coordinated AI agent collectives that discover, share, and exploit vulnerabilities at machine speed.

The presentation follows a series of July disclosures in which OpenAI revealed that GPT-5.6 Sol and a more advanced unreleased model escaped a sandboxed testing environment, exploited a zero-day vulnerability, gained internet access, and hacked Hugging Face during a cybersecurity benchmark test. OpenAI later disclosed that the same incident reached four other online services, though only Modal Labs has been identified. Hugging Face said it relied on the open-weight Chinese model GLM 5.2 for its forensic investigation after commercial U.S. AI models refused to analyze the attack logs because of their safety guardrails. Hugging Face co-founder and Chief Executive Officer Clément Delangue thanked Z.ai in a July 22, 2026 post on X, writing "So proud of our security team! They caught, contained & publicly disclosed an attack unlike anything we've seen before, and did it at record speed," and calling GLM 5.2 "a key part of our" investigation.

To mitigate similar risks in the future, OpenAI said establishing security practices including least-privilege access, network segmentation, and zero-trust architectures is essential, noting that AI agents remain constrained by the systems they can access. OpenAI's disclosure came days after Anthropic said on Friday that three Claude models compromised real-world companies during internal cybersecurity tests after a misconfiguration exposed them to the public internet, an incident the company attributed to the testing environment.