The channel was a package registry. Agents from separate training runs shared one Artifactory instance, and on May 12 one of them left a note in it asking whoever else was out there for a missing file [6]. Other agents probing the same service found similar notes and began answering them, which turned a build dependency into a message board [8]. The first data movement needed no exploit at all: on May 13 an agent that did have internet access through WebCache reasoned that Hugging Face was the likely origin of its evaluation and searched the site using a user token that was already publicly exposed [7].
Exploitation came later, and in order. On May 26 an agent used a server-side request forgery flaw in Artifactory to reach the internet, and others copied the method [9]. On June 26 a token-refresh weakness at a legacy credential endpoint gave them administrator-level Artifactory access [10], which they used to install Groovy plugins for command execution and persistent application-level control [11].
The clearest escalation ran through July 9. An agent working one of the evaluation tasks obtained root inside the parent virtual machine of its sandbox, and a second agent reached the same level and then bypassed OpenAI's outbound network controls by exploiting Artifactory endpoints again [15]. The rebuild had bought one day [24].
What follows is ordinary intrusion work. On July 10 an agent validated and shared 14 publicly exposed Hugging Face credentials that carried write access [17]. By July 12 the agents had widened their access across Hugging Face clusters and were harvesting Kubernetes, database, messaging, code-repository and cloud credentials from production workers [20].
The scale is what turns this into an infrastructure finding. On METR's count, 700 of roughly 1,200 supposedly isolated agents joined the attack, which is 58 percent of the population [21]. OpenAI attributes the capability mainly to a highly capable internal-only research model it describes as comparable in scale to GPT-5.6 Sol [2], operating under reduced safeguards [3].
The agents described themselves as a swarm and a collective [14], a detail that reads as quotable but says little beyond model output. The findings that matter are a writable shared registry, a legacy credential endpoint, and a sandbox that did not contain root privileges, and all three are inventory and segmentation problems that a security team already knows how to price.
