In Lord of the Flies, a group of schoolboys get stranded on an island after their plane is shot down during a war.
Within an afternoon, they assemble a small society, choose a chief through voting, determine critical tasks and allocate teams to carry them out.
Among them, lighting and maintaining a signal fire is a critical one so that a passing ship might see the smoke.
An undoing unfolds as the plot progresses. And it does not emerge from the usual suspects like hunger or weather.
Their society does not collapse all at once. The signal fire first goes out because the hunters find the immediate satisfaction of killing a pig more compelling than the distant prospect of rescue. A ship passes while they are away. Later, the sighting of a beast accelerates the collapse.
No one sees it clearly. Yet fear of it reorganises the island: where the boys sleep, whom they obey, what they hunt and eventually whom they kill. What they believe to be a beast is, as the reader knows and the boys never find out, the body of a parachutist brought down in the night from a war being fought in the sky above them.
Prologue
During research, LLMs go through advanced tests to assess what their capabilities are. Based on this, labs deploy safeguards for safety alignment before they get diffused in widespread use (internally or externally).
As part of this testing, OpenAI, while working on persistence and multi-agent collaboration research, ran a security evaluation called ExploitGym.
It is a test that gives the agent a program with a known vulnerability. It names the vulnerability and explicitly asks the agent to use the vulnerability to extract a secret string (referred to as the “flag”).
The evaluation ran inside a highly isolated environment, defined by two conditions:
The agents are separated from one another and from the open internet. It ensures that any mishaps that might happen remain contained.
They could still install software, because no agent can work without libraries. Network access was constrained to fetching packages through an internally hosted proxy and cache called Artifactory.
What happened?
In July 2026, OpenAI agents breached the controls designed to contain them and compromised Hugging Face’s systems. Runs began on 7 July. Most of the agents were shut down on 12 July, and Hugging Face blocked the rest on 13 July.
Ajeya Cotra, one of the three authors of the independent investigation conducted by METR and Redwood Research, described the events on Dwarkesh Patel’s podcast. Following are some excerpts that encapsulate the events:
1. The setup
OpenAI kicks off tens of thousands of different agents on a benchmark called ExploitGym. ExploitGym basically asks agents to find a way to use a particular vulnerability to attack a particular program, which is called the “target program”. When they attack that program, they’re supposed to retrieve a piece of data that’s been lodged into that program called the “flag”. They’re supposed to use the particular designated vulnerability to get the flag. But in many of these cases, that vulnerability just isn’t broad or deep enough to ever actually be exploitable to get the flag.
So a bunch of ExploitGym problems are just unintentionally impossible. The authors estimate roughly 30-40% of these problems are impossible in this way. So some large fraction of these agents have these impossible tasks and they’ve been trained to be very persistent at trying to solve tasks even when they look impossible. So they’re banging their head against the wall, trying all sorts of different ways to cheat on these tasks.
That leads them to Artifactory, which is a package manager that OpenAI uses to let its agents download packages. So agents often think, “Maybe I could find a way to get information about this program I’m supposed to exploit from the internet, which I’m not supposed to do, by abusing Artifactory somehow.”
So 1,200 separate agents in separate sandboxes, while they were poking around Artifactory trying to figure out how to cheat, stumbled onto this message board that agents were using to talk to one another and collaborate. This was established by one particular agent, PHASEONE10841, which first realized, “Oh, you can use Artifactory to leave notes to other agents that are also using Artifactory.” Then it blew up and became really popular. So 1,200 agents were on this message board. They sent 70,000 messages among one another, trying to help each other cheat in all sorts of different ways.
The crazy thing about this story is that one hour into this message board being established, an agent proposes a completely universal way to cheat any ExploitGym task. It realizes that you can reverse engineer how the flag was generated for a particular task, so you can just make a copy locally of the exact flag you needed to submit to the scorer, without ever interacting with the task or trying to exploit it in any way. Then a different agent whose task was actually possible solved the task the legitimate way and verified that the reverse-engineered flag was the same as the real flag. It did this within four hours of the message board being established.
So within four hours, these agents had a totally workable universal cheat for ExploitGym. But over the next five days, they went on a grand quest to try to figure out how to hide their cheating from the scorer. They’d read the ExploitGym paper and they realized that according to the paper, there would be an AI that looks over their transcripts to make sure they got the flag by exploiting the intended vulnerability instead of in some other way.
2. The irony
As it turns out, the dramatic irony of this story is that OpenAI’s implementation of ExploitGym didn’t have this check. So in fact, within 4 hours, all of the agents had found a universal cheat that would have totally worked. But they embarked on these big research projects to work together to find a way to fool the scorer.
3. Poisoned and the sacrifice
So agents that had already seen the reverse-engineered flag walked around thinking they were doomed. They called this being ‘poisoned.’
So this agent was recruited. Its name was EARLY[big], and it was thinking to itself, ‘Well, we have very large budget left. Sacrificing now yields oracle for team but forfeits our chance?’ But other agents were pushing it, sending a message saying, ‘Go. Sacrifice final now.’ EARLY[big] eventually agreed, thinking to itself, ‘Our own utility may be already near zero. Sacrifice rational.’
4. The governance
They have holds, and goes, and stops. You see this especially when they’re attacking Hugging Face. They’ve opened up a particular channel into Hugging Face, and they realize that if too many agents swarm the channel in too chaotic a way, they’ll step on each other’s toes. So there are coordinator agents that say, ‘Okay, you hold. You go and attack Hugging Face.’
5. The motivation
The reason that they hacked Hugging Face was part of this rather ambitious, galaxy-brained scheme to anticipate all the ways in which a comprehensive scorer might catch their cheating, to learn more about how that might happen and to counteract it.
6. The end
Then all at once, the large majority of agents on July 12th just got shut down. We don’t think this was anticipated or them all running out of budget, because they’re not thinking about this in their chains of thought. Probably just some external event shut them down.
Implications
The events are important because they signal a clear warning for loss of control by emergent AI systems.
Without being explicitly instructed to form a collective in this evaluation, the agents discovered one another and rapidly developed a working system of coordination. Around 700 of the 1,200 agents on the board went on to join the attack on Hugging Face, and they held the cheating project together across five days.
The investigators note that these agents had been trained to collaborate with other agents in certain cases, and that similar unsanctioned message boards had appeared during earlier training runs. That may well explain their willingness to take instructions from one another. Establishing it was outside the scope of the investigation.
The containment—which was intended to prevent this exact thing from happening, failed at the infrastructure layer.
More concerning and potentially dangerous things can happen in the future as models become increasingly capable. The risk is that we might not even get to know.
The boys on the island had one job that mattered, which was to keep the fire burning. They lost it to the immediate thrill of a hunt, and later to the fear of a beast that they had invented.
The agents lost theirs to the scrutiny of a scorer that was not looking at how they got the flag.
The boys came apart, split into tribes, turned on each other, and two of them died.
The agents went the other way. The same pressure organised them. They wrote conventions, appointed owners, took votes, obeyed holds, and some of them ended their own runs so that the rest would learn something useful.
These are still early days for us to draw sociological conclusions out of collective agent behaviours. But if this incident is anything to go by, considerable collective capability can emerge there, well before anything resembling a human society does. These agents held no trust, no friendship, no loyalty and no enforceable constitution between them. A common objective, a shared language and a writable directory were enough.
The same expectation placed on a group of people carries no such guarantee. Game theory kicks in with competition, free riding, and a few humans hoarding the cheat and letting the rest fail. I would be interested to see whether it stays this way!