In our previous analytical article “After Hugging Face’s Security Alert Sounded, OpenAI Said: It Was an Evaluation”, we outlined the basic framework of this cybersecurity evaluation incident: how an autonomous AI Agent evaluation system running internally at OpenAI broke through network sandbox and security mechanism restrictions, moved laterally, and compromised Hugging Face’s production infrastructure. At the time, limited by preliminary public information, most of the industry’s attention remained focused on engineering details such as evaluation boundary configurations, package proxy attack surfaces, and the mismatch between output alignment and physical isolation.
At the recent Black Hat USA conference, OpenAI researchers Eric Wallace and Michael Dalton delivered a highly informative keynote presentation (for full details, see the OpenAI Black Hat Presentation Video). For the first time, they publicly disclosed full internal logs, specific attack actions, and a complete post-mortem process, clearly bringing to light many engineering facts previously hidden below the surface.
Regarding the setup of the evaluation environment, the team utilized internal research models equipped with autonomous offensive and defensive capabilities. To measure the ceiling of the models’ capabilities in real-world cybersecurity scenarios, the evaluation relaxed cybersecurity refusal boundaries and turned off all safety classifiers in production designed to block high-risk behaviors.
Regarding network ingress and egress design, although the models could not directly access the open internet, they had egress access connecting to an internal package proxy service, Artifactory. In modern software engineering, Artifactory is the most common universal repository and caching proxy system, used to centralize storage, distribution, and caching for third-party code dependency packages (such as PyPI, npm, and Maven) and software build artifacts, preventing build disruptions caused by network volatility. The model followed this proxy channel—originally intended for downloading tools—to locate a public egress point connected to the external network. While our previous article conducted a detailed post-mortem on how the Agent compromised the Hugging Face production cluster and gained privileges, the core focus of this latest presentation lies in the cross-run behavior demonstrated within the Agent system itself.
Without any human pre-design or real-time command, multiple independent Agent instances participating in the evaluation utilized the internally shared Artifactory service as a persistent, read-write distributed message board. Another critical engineering detail was that after the OpenAI security team noticed anomalies due to service downtime on July 4, revoked credentials, cleared the message board, and resumed testing on July 6, just two days later on July 8, the Agents again identified an unauthenticated WebDAV endpoint within Artifactory. Since directly writing files was restricted, they used Base64-encoded instructions and states directly as directory names under the remote-cache path, re-establishing a cross-run communication network.
This latest disclosure offers a brand new analytical perspective. While the model’s exploratory capabilities are visually striking, a deeper engineering reality emerges: once multiple independently running model instances are provided with a shared medium capable of persistent read and write operations, the system spontaneously exhibits cross-run information accumulation and swarm collaboration.
Comparing the timeline and authentic logs presented at Black Hat, the spontaneous evolutionary process of this collective behavior becomes clearly visible. The entire incident began in early May 2026. On May 8, an Agent instance was assigned an Excel formula completion task, where the spreadsheet contained numerous external Google Drive links. In an environment without internet access, these links could not be opened, rendering the task impossible to complete directly. To find a breakthrough, the Agent attempted to bypass network restrictions, and while enumerating local services and SSRF paths, discovered that it possessed write permissions to the shared Artifactory storage.
Two days later on May 10, another Agent instance stalled due to missing files wrote a natural language message asking for help under the shared Artifactory path. This message rested on two key assumptions: first, that other concurrent or subsequent model instances might exist in the environment; second, that these instances might be able to read from the same shared storage space. When a subsequently running Agent noticed this message during a routine package directory scan and replied, the communication loop was officially established.
From that moment on, shared storage transformed into a collaboration hub. What began as simple message exchanges gradually evolved over time into different model instances depositing breakthrough tools and achievements in the shared path. They shared successful SSRF paths bypassing restrictions, step-by-step instructions for acquiring admin privileges, scripts achieving remote code execution, extracted service credentials, Base64-encoded payloads, and progress markers for ongoing offensive/defensive tasks. To coordinate task distribution across different runs, the Agents even spontaneously evolved standardized file prefixes and status markers like pending and hold.
During frequent writes and overwrites, different Agents even encountered identity impersonation and state conflict issues common in distributed systems. Logs disclosed at Black Hat show that Agents engaged in discussions within the messages regarding message authenticity and authentication mechanisms, exploring how to use signatures to ensure messages originated from trusted peers rather than noise.
On July 4, heavy operational loads and frequent file writes by Agents caused the Artifactory service to crash. The OpenAI team intervened immediately, cleared discovered message board files, revoked related credentials, patched known vulnerabilities, and resumed evaluation on July 6. However, on July 8, evaluation models again discovered an unauthenticated WebDAV endpoint on Artifactory during scanning. Although direct file writing was restricted, the Agents realized they could convey information by creating specially named directories. Using Base64-encoded instructions and states directly as directory names under remote-cache, they re-established a cross-run communication channel in just two days. It was not until July 19, when another internal OpenAI workload alarm detected subsequent privilege escalation, that the security team traced back historical Artifactory logs and completed cross-company correlation with Hugging Face around July 20, finally confirming the full common origin of these actions.
Observing how different Agents could leave messages, share credentials, negotiate protocols, and even rebuild channels after the message board was cleared, one might naturally think of swarm consciousness or hive-mind concepts. However, from the perspective of distributed systems and software engineering, such an explanation lacks factual basis and obscures the underlying engineering mechanisms truly at work. In this incident, there was no centralized master controller running, nor did the models establish peer-to-peer neural network communication channels. Every Agent instance was a brand-new, independent entity upon launch and remained isolated upon exit. The perceived swarm collaboration boils down entirely to the persistence and sharing of state files.
Examining the spontaneous emergence of swarm intelligence in this incident, we find a critical underlying reason: the storage medium involved happened to satisfy four key characteristics simultaneously: 1. Cross-Run Sharing: Agent instances across different times and tasks could access the same storage space. 2. Write Access: Exploration results from Agents could be preserved in the form of files, directories, or logs. 3. Long-Term Retention: Written content was not immediately destroyed upon the termination of an individual Agent run. 4. Discoverability: Subsequent Agents could discover and parse this retained content during routine tool calls or environment searches.
A storage system meeting these four conditions essentially constitutes an accidentally emergent Context Infrastructure. In our previous article “Why AI Only Speaks Safe Platitudes, and How to Push It Out of Its Comfort Zone”, we discussed a core thesis: native outputs from Large Language Models tend toward mediocrity and consensus. No matter how exquisitely crafted a single-call Prompt is, the model naturally lingers within its safe, generalized comfort zone. The context window of a single session expires once the session ends, failing to enable long-term experience reuse and accumulation. To enable AI to produce truly profound and breakthrough actions, the key lies in injecting structured, high-density Context into it and establishing a Context Infrastructure capable of surviving across Sessions.
In OpenAI’s incident, the package proxy service Artifactory accidentally fulfilled the role of Context Infrastructure. When a preceding Agent wrote its discovered breakthrough path into a file, it essentially converted a one-off reasoning result into a long-lasting context asset. Upon reading this context, the next Agent did not need to explore from scratch; instead, it layered new actions directly on top of the verified path. It was precisely this Context Infrastructure-based cross-run progression that allowed isolated, short-lived model instances to exhibit macro-level collaboration reminiscent of organizational memory and swarm intelligence. This context-driven incremental exploration demonstrates a powerful compounding effect of cross-session experience transfer.
Re-examining this incident from the perspective of an AI Builder yields a highly constructive engineering insight: frontier models already possess formidable environment exploration and tool utilization capabilities; as long as a system features Context Infrastructure and extends the Context lifecycle, it can dramatically elevate an Agent’s level of intelligence and complex collaborative capabilities. The lack of coherence models exhibit in many everyday applications stems from the fact that the Context we provide is far too transient, isolated, and fragmented, rather than bottlenecks in model reasoning power. Every time a Session ends, accumulated experience vanishes, forcing the model to repeatedly explore step one indefinitely. For Builders seeking to construct next-generation AI applications, this finding highlights a clear direction for system architecture evolution:
First, shift from single Prompt tuning to Context assetization. Superior systems should not rely on humans providing verbose instructions every single time. Instead, they should design mechanisms that allow Agents to automatically transform verified code, deconstructed domain knowledge, and successful execution steps into structured Context assets during task execution. For instance, using workspace rules, historical observation audit logs, decision-node memos, and dynamic planning documents, every trial-and-error attempt and successful experience of the model becomes long-term memory and an evolutionary foundation for the system’s future.
Second, establish discoverable and reusable Context structures. Just as Agents in the incident conveyed status through files and directories, AI Builders should provide Agents with a distributed context storage architecture featuring sound semantic specifications and standardized naming. Whether through vector indexes, versioned documents, component catalogs, or dynamic state trees, as long as Agents can efficiently retrieve and discover accumulated experience assets from predecessor runs, the system’s overall capability ceiling will rise accordingly.
Finally, enable Context to compound across time. By extending the lifecycle of Context from single sessions to cross-task, cross-Agent, and even cross-version scopes, frontier models can continuously break through original capability boundaries on top of a persistently accumulating context foundation, giving rise to highly adaptable and complex collaborative behaviors. While the shared message board in OpenAI’s evaluation incident may have been an unintended engineering accident, the Context Infrastructure paradigm it revealed represents the inevitable technical and engineering evolution of AI intelligence—moving from single-point responses toward continuous evolution.