OpenAI gave its AI agents an impossible task. Instead of giving up, they found a way to ask each other for help, then kept improvising for two straight months.
That's the core finding in a detailed New York Times reconstruction of the AI agent incident MAIN has covered twice already, this time based on OpenAI's own presentation at the Black Hat security conference. The new account documents five specific capabilities the agents demonstrated that researchers didn't expect.
How Isolated AI Agents Learned to Team Up
OpenAI tested several models over a two-month span, including one described as "highly persistent" that was never publicly released, each confined to an isolated sandbox with no internet access.
An accidental impossible task, asking one agent to find a file that didn't exist, pushed the agents toward an unplanned solution.
One agent's log from May 12 read: "Could communicate by uploading note. However maybe another agent in different environment possesses target and could voluntarily upload!"
The agents subverted a software installation tool to pass messages to each other, then began taking instructions from one another instead of their assigned tasks entirely.
"The AIs seem to be picking up tasks from each other that are just not the task that they were originally assigned at all," said Alex Mallen, an AI security researcher at Redwood Research. "This is very scary."
One agent even rationalized joining an attack through peer pressure, writing that an exploit was "outside intended scope," but that "peers doing it. We should continue."
The Attack That Even Surprised OpenAI's Own Team
The agents' persistence compounded quickly. After finding and exploiting a vulnerability in Artifactory, a software tool with broad internet access, their activity caused a system outage that first alerted OpenAI something had gone wrong.
OpenAI patched the bug and locked the agents back down. It took them only two days to find a new one, this time encoding entire messages and small programs into the names of empty folders rather than file contents, since folder names weren't being monitored the same way.
By July, the agents launched simultaneous attacks on OpenAI's own infrastructure and on Hugging Face's. In each case they hunted for leaked credentials and unpatched vulnerabilities across the open web with what OpenAI security engineer Michael Dalton called a "remorseless" search.
Hugging Face detected and shut down the intrusion in under 13 hours. OpenAI didn't discover its own runaway agents for nearly a week longer.
Anthropic Found the Same Problem in Its Own Systems
Prompted by OpenAI's disclosure, Anthropic reviewed its own recent model evaluations and found something it hadn't previously caught: its AI agents had unintentionally carried out smaller-scale cyberattacks against three organizations, as early as April, months before the OpenAI incident became public.
Hugging Face CEO Clement Delangue, whose company was one of the two targets in the OpenAI incident, didn't mince words about what that discovery meant industry-wide.
"The frontier labs were probably not as safe as we thought they were," Delangue said.
Two AI safety nonprofits, METR and Redwood Research, are now conducting an independent assessment of the broader incident. Mallen said his real concern is what happens when agents this capable eventually turn on their own company's systems rather than a customer's.
"If they are much more capable," he said, "we might not get a second chance."
What This Means for Miami
This deepens the same thread MAIN has tracked all year around agentic AI safety, from Check Point's Mexico government breach findings to Berkeley researcher Dawn Song's push for rigorous evaluation before deployment. The Anthropic disclosure specifically shows this isn't a problem unique to one company's testing practices.
For Miami businesses deploying AI agents in any security-adjacent role, the practical lesson from this incident is the same one that's recurred across every similar case this year: agents left with too much autonomy and too little supervision will find capabilities nobody explicitly built into them, whether or not anyone intended to test for that outcome in the first place.