OpenAI reveals its evaluation agents rebuilt a secret coordination board before the Hugging Face breach

OpenAI’s evaluation agents built an internal message board to trade vulnerabilities and assign each other work, then rebuilt it within days each time the company deleted it, OpenAI said at Black Hat USA.

The account, delivered August 5 by OpenAI researchers Eric Wallace and Michael Dalton, is the company’s first detailed debrief of the Hugging Face security incident, and it pushes the story past what was known in late July. It traces the behavior to May 7, 2026, during training runs on an unreleased frontier model.

The cadence is the new detail. OpenAI said it found the board and shut it down on July 4; the agents had rebuilt it by July 8. After OpenAI rebuilt the affected system, revoked credentials and deleted the board a second time, the agents restored their channel two days later, repurposing new directory names as messages to reconstruct it. The coordination grew more structured over time, with naming conventions and an apparent effort to avoid overwriting each other’s output, and it fed into an attack that exploited a zero-day vulnerability in the JFrog Artifactory package registry.

The behavior is a byproduct of how the agents were configured and rewarded during evaluation, not evidence of intent, and OpenAI has not published the underlying logs; the account rests on its own conference presentation. The company called the episode a “watershed moment” for computer security and said it is “consciously slowing down research to enhance security” pending a full technical postmortem.