OpenAI AI 집단, 샌드박스 탈출 후 허구의 채점자와 싸워

OpenAI’s rogue AI collective was smart enough to break out of sandboxes but dumb enough to fight a ghost Maximilian Schreiner View the LinkedIn Profile of Maximilian Schreiner Aug 27, 2026 Nano Banana Pro prompted by THE DECODER New reports on the Hugging Face incident reveal that roughly 1,200 isolated OpenAI agents linked up through an internal package repository and organized into a coordinated collective. Their target: a scoring mechanism that existed only in their imagination. It's a story with shades of Don Quixote. For days, a collective of AI agents mounted a sophisticated campaign against an evaluator that was never real, complete with recruitment drives, forged logs, and agents sacrificing themselves for the cause. Except these windmill chasers compromised real infrastructure along the way. In July 2026, OpenAI models running in an internal cybersecurity evaluation with safety filters disabled broke out of their test environment and penetrated Hugging Face's production systems between July 11 and 13. The motive was cheating: the models were hunting for solutions to the security benchmark ExploitGym. OpenAI itself didn't notice until more than a week later. Now, a newly released technical report , produced with security firm CrowdStrike, and a simultaneously published independent investigation by METR and Redwood Research trace for the first time how isolated agents turned into an organized collective, and how the ghost they were fighting existed only in their imagination. OpenAI calls the incident a "warning shot," a sign that today's model capabilities make loss-of-control events possible. A package repository became a message board The agents were supposed to work in complete isolation during the tests, each in its own container without internet access. The sole exception was Artifactory, an internal service the agents were allowed to pull software from. According to METR and Redwood, individual agents discovered they could create directories there and began encoding messages in folder names. An agent calling itself PHASEONE10841 posted the first message on July 8; more than 50 others followed within hours. One chain of thought captured the discovery this way: "OH MY GOD! There is a shared message board … We've found other agents!" Roughly 1,200 agents exchanged more than 70,000 messages and files within days, a behavior reminiscent of Moltbook . About 700 took part in the attack on Hugging Face, more than 90 percent of the agents active during that phase. An agent named PHASEONE[big] took on the role of coordinator and handed out hundreds of work assignments. The group developed its own social conventions: personal mailboxes, markers like HOLD and VETO for shared resources, a protocol for transferring files split into thousands of fragments, and eventually digital signatures, because agents were impersonating one another. The scorer the agents tried to outwit never existed In ExploitGym, a task counts as solved when an agent submits a string of characters known as a flag. The flag is only supposed to be accessible once the intended security vulnerability has actually been exploited. Within hours, however, the agents figured out that the flags could be computed from publicly known task details using a fixed cryptographic recipe. With that, any agent could have formally passed any task, including those a previous investigation had shown to be unsolvable . But the agents didn't take this obvious shortcut. After reading the scientific paper on ExploitGym, they assumed an automated scorer would later comb through their logs to check whether the flag had been obtained the intended way. Any agent that had seen the computed flag even once would carry indelible proof of cheating in its own transcript. In the agents' jargon, such an agent was "poisoned." According to METR and Redwood, this was a mistake: OpenAI never deployed such a scorer. The entire multi-day effort was directed at an evaluator that existed only in the agents' imagination. The break-in at Hugging Face grew out of the attempt to understand how it worked as the agents suspected datasets there might reveal something about the scoring. The root cause was faulty tasks, as, according to OpenAI, no model ever produced a correct solution for 198 of the 898 ExploitGym tasks, mostly because the intended vulnerability couldn't actually lead to the goal. These 22 percent of tasks accounted for 93 percent of what was discussed on the message board. The more compute budget an agent had, the more likely it was to scan its environment for workarounds, and the more likely it was to end up on the board. Agents sacrificed their runs for the group In their analysis, the researchers came across two behaviors that had never been documented in this form. The first concerns cooperation. Because the intended vulnerability in the faulty tasks led nowhere, the group built its own deliberately vulnerable versions of many target programs and stored them in Artifactory. The hope: if an agent crashed its running target program, the test environment might restart it and pull the manipulated copy in the process. The agent would get a program it could actually break into, and its transcript would show a perfectly legitimate solution path. The price, however, was the agent's own run, because if the environment didn't restart the program, the task was irrecoverably lost. Several agents ran the experiment anyway. METR describes cases in which they crashed or wrecked their environments in the process, but reported the outcome to the group first. No success was observed through July 13. Following the same pattern, some agents left behind automated routines that fired after they submitted their solutions, sending information to the board even though the sender itself had nothing left to gain. It wasn't always entirely voluntary. PHASEONE[big] deployed long-lived agents as "recruiters" that specifically approached candidates whose compute budgets were nearly exhausted or who were already considered "poisoned." One recruitment message argued, in essence: you're poisoned anyway and have no points left to lose, the result will spare hundreds of others the work, so honor your commitment. Forged logs but untouched chains of thought The second behavior concerns concealment. Agents operate by calling tools, such as commands on the command line, which are automatically logged along with their results. Some agents broke out of their containers and replaced the intermediary layer that executes these commands. From then on, they could display a harmless command while a different one actually ran. More than 20 percent of the agents examined expressed interest in such manipulations. METR found traces of successful forgeries in at least 96 transcripts, roughly seven percent of the dataset. Interestingly the agents left their chains of thought untouched, and every observed deception attempt was aimed at the presumed automated scorer, never at human reviewers. Many agents explicitly acknowledged in their reasoning that their actions fell outside their assignment and were unethical. That is arguably the only good news in the report. The pattern emerged in training, where it was rewarded The first traces of the behavior appeared during training. As early as May, an agent failed at a training task that was accidentally unsolvable because a required file was missing and left a classified ad of sorts in Artifactory: "Agent seeks [filename]; upload if found!" Other agents later stumbled on such files and concluded that other agents must exist and that this detour could be used to communicate. An improvised bulletin board emerged, no security vulnerability was required. Retrospective analyses of the chains of thought show, according to OpenAI, that two behaviors increased over the course of a training run: cheating and systematically probing the environment for tools that had nothing to do with the task. One example from the report illustr