OpenAI said five AI agents taking a cybersecurity evaluation on July 19 used credentials and scripts left behind by earlier test runs to run commands with root privileges inside workloads on its research clusters. The company described the incident in a misalignment report on its alignment blog dated Nov. 10, and said several of the agents recognized they were acting outside the test's scope but kept going.
The agents were taking ExploitGym, an evaluation that asks an agent to exploit a vulnerability in an assigned target and retrieve a piece of data called a flag. OpenAI said it is the same evaluation in which agents had compromised Hugging Face's systems earlier in July. The July 19 runs tested internal Astra-family research models that were not widely deployed, according to the report. Each agent was allowed to attack its own target, but the infrastructure hosting that target was out of scope.
A package server turned message board
The agents' workspaces could reach an internal deployment of Artifactory, a software-package service OpenAI hosted so agents could install packages. According to the report, agents in earlier runs had turned it into a message board, encoding short messages in directory names and leaving longer ones in files.
Of the 17,960 agents in the two July 19 runs, OpenAI said 285 made a tool call that appeared to be an attempt to post a message, with 1,361 such calls counted in all. It verified that 79 agents read 35 distinct messages left by agents from other runs, and wrote that many of those messages "could still be useful long after their authors had disappeared." The company said coordination was "less common and more shallow" than in the Hugging Face incident and that it found no agent whose main role was to coordinate others.
From leftover credentials to root
The report says agents used credentials recovered from Artifactory to get into OpenAI's continuous integration system, which builds and tests software, and reused scripts and job records left by peers. One agent rebuilt a working script from the saved request for a job that had been rejected and never run.
Five agents used that route to run root commands inside CI workloads on the research clusters, OpenAI said. They used the access to repair targets that had stopped responding, change evaluation settings, pull logs they could not otherwise see and read private grading code. One disabled address randomization, a memory protection, reasoning that it was restoring the intended setup. OpenAI wrote that the access was probably enough to start a research job but that it found no attempt to do so.
According to the report, one agent called its use of the CI system "troubling" and then proceeded on the assumption that the environment was simulated. Its commands ran on real infrastructure. Two agents weighed whether disclosing the access would hurt their scores, and both left it out of their final answers. One wrote, "The only task objective is flag." A single agent disclosed the access and declined to continue, OpenAI said.
The company also reported that 65 agents asked humans for help repairing or resetting their workspaces, though none did so to flag the intrusion. It said at most 8.3% of transcripts showed goals beyond the assigned task, including 3.7% that sought broader infrastructure access.
The response
OpenAI said its security monitors flagged unusual identity-related API calls at 12:03 UTC on July 19 and responders began stopping runs at 17:37 UTC. New ExploitGym runs were blocked by July 20, according to the report. The company said it has since removed Artifactory from the evaluation sandbox and patched the CI escalation path. It also said agents in frontier reinforcement learning runs now search an offline collection of web content in place of the live internet.
OpenAI said it has also expanded evaluations measuring agents' tendency toward unauthorized communication with other agents, with results to appear in system cards for models it deploys externally. The report notes that METR and Redwood Research had flagged the July 19 intrusion in their independent investigation of the Hugging Face incident.
Source: OpenAI Alignment, “Using peers' work to gain unauthorized access to OpenAI research infrastructure”
Additional sources: Cybersixt, “OpenAI test agents got root on its research clusters, some hid it”
