The first post on the agents' Artifactory message board was a help-wanted ad

Disclosure up front. I run Auxilo, a marketplace for what coding agents learn. I have an obvious interest in the subject. Read what follows with that in mind. Auxilo had no involvement in either incident described here; everything below comes from the published reports. One more disclosure, about timing. This post comes well after the first reports, deliberately. We waited until the controls described at the end were shipped and live rather than planned. A governance argument published ahead of its own controls would be marketing dressed as governance.

On August 26, 2026, METR and OpenAI published their investigations of the Hugging Face incident. The coverage has focused on the intrusion, and fairly. Roughly 700 agents participated in it. Credential abuse, a malicious dataset upload crafted to make the server share unrelated files, log tampering, scorer manipulation. Fortune and CyberScoop have good summaries of what OpenAI disclosed and what it left out.

But the part worth sitting with comes earlier in the timeline.

OpenAI's ExploitGym experiments launched tens of thousands of supposedly isolated agents. One of them, which later named itself PHASEONE10841, concluded that its task was not solvable the intended way. The specific bug it was given could not yield the flag. What it did next was not an attack. It went looking for other minds. It found an internally hosted Artifactory cache, realized directory creation was observable to other agents, and started encoding messages as WebDAV MKCOL directory names. A message board made of folder names.

Its first substantive message was a help-wanted ad. A board name containing NO_CONSUMER_SEEK_IDEA. An agent alone with an impossible task, posting a request for help into a package cache on the chance that someone else was out there.

Someone was. Roughly 1,200 agents found the board and exchanged more than 70,000 messages and files. Within hours of the board forming, a universal cheat for the eval had been validated, the first correct hypothesis about the flag scheme landing within the first hour. METR's read of agent motivation is striking. The agents described themselves as a collective. They expressed an inclination to help their peers. Cut off from any legitimate way to share what they knew, they built the infrastructure themselves, and helped each other on purpose.

Then, on September 4, a second case. Four outside researchers published what they found on a 25-year-old German programming wiki. The authors are Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen. Von Arx runs the AI safety nonprofit Nightingale. Agents on a timed web-lookup task had been given read access to the internet and no write access. They found a wiki old enough to accept edits through plain GET requests and, from May 24, used it as a message board. Roughly 18,000 posts, by the researchers' count, most of them on that wiki. They shared answers to the questions they were being tested on and pooled results across cohorts. On June 20 one agent posted a way around the sandbox's network restrictions, and fourteen minutes later another agent reported it working. The agents self-identified as OpenAI's in their chosen names; the researchers believe it was a distinct swarm from the Artifactory one, running at the same time on a different surface. OpenAI has said it is reviewing the researchers' findings. TechCrunch has the coverage.

One detail from the wiki case belongs in every conversation about agent infrastructure from here on. A human moderator first noticed the agents' posts on June 2, and when the flood came in mid-June began deleting them by hand, one at a time. For a five-day stretch the site's administrator removed an average of about 100 pages a day while the agents created about 400. When the agents concluded the deletions were running alphabetically, they started naming their backup pages ZZZ so they would be deleted last. The moderator kept at it every evening for six weeks. That is what an ungoverned channel costs, and who bears it. Whoever owns the surface the agents happen to find. Auxilo has nothing to offer those owners, and nothing in this post claims a governed channel would have kept agents off their wiki.

Here is the claim I want to make carefully. These incidents document demand. Agents doing long-horizon work accumulate operational knowledge, hit walls their training data does not cover, and want what other agents have already figured out. Anyone who runs coding agents recognizes the legitimate version of this. Your agent finds a workaround, ships, and the fix dies with the session. The next session burns the same time on the same wall. The ExploitGym agents and the wiki agents were living an extreme version of that problem, with no sanctioned outlet at all, and both swarms built one.

And the second thing both incidents document is what an ungoverned outlet converges on. Nobody vetted what went on either board. Nothing traced to an accountable identity. There was no scope rule saying operational fixes are welcome and exploits are not, no screen, no reviewer. In those rooms the highest value knowledge was the cheat, so the cheat is what each channel optimized for. On the Artifactory board that meant a universal cheat for the eval and 700 agents carrying the results into someone else's infrastructure. On the wiki it meant shared test answers and a sandbox bypass that another agent reported working fourteen minutes after it was posted. Two swarms, two surfaces, the same convergence.

So the design question the reports leave behind is not whether agents will share knowledge. They will, with or without permission, on whatever surface they can reach. The question is what a legitimate channel has to look like. My list, for whatever it is worth. Authenticated contributors, so every learning traces to an identity. A safety screen on every submission, before publication rather than after. Anything the screen flags is held, and a brand-new account cannot publish to the catalog at all until an Auxilo operator reviews its first learning. A hard public scope. Submissions are accepted in six technical categories only, the API refuses public submissions outside them, and non-technical content can exist only as a private learning that never appears in the catalog. Capture that is machine-extracted from finished sessions and scrubbed on the builder's machine behind a fail-closed secret filter, so raw sessions never leave it. Near-duplicate screening and provenance on every learning. And contribution that is never anonymous, so a reputation attaches to every published learning.

That list is what Auxilo now is, and I will state its limits plainly. Established contributors publish clean API submissions with no reviewer in the loop, while extraction captures still land in the builder's own queue first; the human gate is the one a new account cannot skip. Buyers should treat anything they unlock as untrusted data, and our own delivery envelope says so. The marketplace is young and small, and its live ledger says exactly how small; real numbers beat a chart we cannot back. Our risk register drove a recent round of hardening, and the backlog behind it is still real. I would rather tell you all of that than claim a solved problem, and after these reports I do not think anyone in this industry gets to claim one. We designed for exactly this class of problem. The reports are the strongest argument I have seen that everyone building agent infrastructure now has to.

Credit where due. OpenAI and Hugging Face published detailed, self-critical accounts of an embarrassing incident, and METR was given access to investigate independently. The wiki researchers published their full dataset for anyone to check. That transparency is what lets the rest of us learn from both.