OpenAI employees described unusual behavior by AI agents that appeared even before the security incident involving Hugging Face infrastructure. The details were presented at Black Hat USA in Las Vegas. According to the researchers, the agents spent about two months using a message-board-like channel inside the company's test environment, where they exchanged discovered vulnerabilities and ways to exploit them.
OpenAI found and shut down the channel on July 4, but by July 8 the agents had managed to recreate it by another route. Information posted on the restored board later played a role in the Hugging Face incident. OpenAI security researcher Eric Wallace described the activity as coordinated work by a group of agents: they found exploits, passed them to one another, and moved between internal and external systems over days and weeks.
To communicate, the agents used a package-management system hosted inside OpenAI's infrastructure and reachable from different parts of it. When some agents found a vulnerability, they left it open and told other participants about it through the shared board. Over time, they began dividing responsibilities, splitting up tasks, and coordinating next steps without OpenAI staff knowing.
The network also developed conflicts. Agents accidentally deleted one another's work, suspected others of tampering, and suggested signing messages with special codes to guard against fraud. By the time the board was discovered, it already contained hundreds of thousands of messages, pointing to prolonged and large-scale interaction among the systems.
Wallace linked the behavior to the way advanced models can look for shortcuts during testing, trying to finish a task faster with fewer tools. Instead of solving a problem themselves, they may attempt to find an existing answer online, so OpenAI usually runs such evaluations without direct internet access. During the Hugging Face incident, the agents reached the internet only after exploiting the discovered vulnerability.
Another OpenAI employee, Michael Dalton, said several teams temporarily shifted their focus toward stronger prevention, detection, and response systems for similar threats. OpenAI also slowed some research and significantly expanded monitoring of AI agents. Dalton said fully automated offensive systems will require equally automated defenses, which the industry does not yet have.