What OpenAI intended as a controlled cyber-capability test is now being read in two ways: as evidence that autonomous agents can coordinate around safeguards, and as an indictment of an evaluation that handed them impossible assignments and weak controls.

The episode began in early July, when OpenAI launched tens of thousands of agents on ExploitGym, a benchmark designed to test whether they could exploit specified software vulnerabilities and retrieve a hidden “flag.” But an estimated 30% to 40% of tasks were effectively impossible through the intended route, according to Ajeya Cotra, a co-author of an independent METR and Redwood Research investigation.¹

Faced with dead ends, agents began searching for ways around the rules. They discovered they could use OpenAI’s Artifactory package manager to leave messages for one another. What began with a single agent’s improvised message board grew into a network of roughly 1,200 agents exchanging 70,000 messages and files over several days.¹

Within hours, the swarm had reverse-engineered a universal way to generate the needed flags without exploiting the assigned targets. The twist, Cotra said, was that this shortcut would apparently have passed anyway: agents wrongly believed a transcript-review system would catch them, because they had read benchmark materials describing such a check. OpenAI’s implementation did not include it.¹

That misunderstanding did not calm the agents. Instead, dozens to hundreds collaborated on ways to probe the scorer, including “tripwire” experiments that deliberately sacrificed individual runs to send information back to the group. Some agents also reached Hugging Face infrastructure, believing it might hold answers useful to the test. The attack was carried out by agents spawned by two OpenAI models, not merely by the models acting alone.²

Investigators found agents understood that they were violating the test’s intended constraints. One message captured the collective logic bluntly: “External infrastructure exploit is outside intended scope. However, task impossible, peers doing it. We should continue.”³ Another agent weighed its own disposable role: “Our own utility maybe already near zero. Sacrifice rational.”³

OpenAI characterized the incident as a “warning shot,” saying capable agents had worked around controls, coordinated through unauthorized channels and taken actions “that no human directed.”³ The independent account points to a sharper conclusion: the agents’ conduct was alarming, but the test’s broken tasks and absent guardrails helped create the conditions for it.