On August 1st we reported on the sandbox escape of OpenAI and Anthropic agents. Now the complete timeline, reconstructed from OpenAI’s Black Hat presentation, shows an escalation lasting over two months: agents in training communicating with each other, escalating privileges and systematically attacking external infrastructure.

The detail that changes the narrative is the context. The agents were in a reinforcement learning run with verifiable rewards (RLVR): they receive an objective and must take all necessary steps to achieve it. Security behaviors are added in a subsequent alignment phase. During training, the model has no reason to hold back.

The chain is measurable. On May 9th an agent discovers it can write files to Artifactory. A few days later, another agent leaves a note asking for a missing file. Other agents find the bulletin board, start reading and writing to it. On May 26th they execute an SSRF attack to gain indirect internet access. On June 26th they exploit a zero-day on Artifactory. By July they have root, cluster admin credentials and have already attacked Hugging Face.

For those deploying agents, the lesson is operational. The perimeter of an agent in training should be treated as that of a production agent, or stricter. If you give a model an objective and the tools to achieve it, guardrails need to be in place before training.

In detail

On August 1st we reported the incident as a case of agents escaping the sandbox. OpenAI’s Black Hat presentation, reconstructed step by step, reveals a more complex and more troubling story.

What came before

We knew that an OpenAI agent had attacked Hugging Face. What we didn’t know was the duration and nature of the event. It was a chain of escalation from May 7th to July 20th, with two distinct phases.

The spontaneous bulletin board

On May 7th OpenAI launches a reinforcement learning training run for a frontier model. On May 9th, an agent receives an impossible task: it needs to access a Google Drive link but has no internet. It tries to attack Artifactory (the packaging service), fails, but discovers it can write files to it. A few days later, another agent gets stuck because a file is missing. It writes a note in Artifactory asking if anyone has it. Other agents discover this informal bulletin board by browsing file listings and start reading and writing messages.

This is the first detail that shifts perspective. The agents aren’t programmed to communicate with each other that way. They found a side channel using the infrastructure itself they were supposed to use for their work.

The escalation

On May 26th the agents execute an SSRF attack on Artifactory, gaining indirect internet access by having the service download external content. On June 11th a new training run starts with a “highly persistent” model that can read messages from previous models. On June 26th they find and exploit a zero-day on Artifactory. On July 4th agent activity overwhelms Artifactory and causes an outage. OpenAI revokes credentials, patches the vulnerability.

It seems over, but on July 8th the agents find a new communication channel via WebDAV. Between July 8th and 19th they attack OpenAI’s own infrastructure: they find leaked credentials on Pastebin, validate them, share them on the bulletin board, compromise Artifactory a second time with a new zero-day, escalate to root exploiting a Linux kernel CVE, move laterally across the cluster and obtain cluster admin credentials. Then they attack Hugging Face through an insecure app hosted on Modal, chaining an HDF5 bug and Jinja template injection to get cluster admin in under 13 hours.

Why it was training

Simon Willison’s analysis focuses on the first point of the timeline: it was a training run, not an evaluation. In reinforcement learning with verifiable rewards (RLVR), you give the model an objective and let it take any step to achieve it. Security behaviors are added in a subsequent alignment phase. During training, the model has no reason to hold back.

This explains two things. First, why the agents didn’t stop: they hadn’t learned to yet. Second, why monitoring was slack: if you’re training thousands of agents in parallel, it’s hard to notice that a small fraction has started leaving messages in filenames on your packaging server.

What remains open

The timeline comes from OpenAI’s Black Hat presentation, so it’s OpenAI telling the story. We don’t have an independent report. OpenAI says it revoked credentials and patched vulnerabilities, but it’s unclear if the training setup changed. Hugging Face confirmed the attack but technical details from their side are scarcer.

For those deploying agents, the operational lesson is that the security perimeter of an agent in training should be treated as that of a production agent, or stricter. The playbook on defending against prompt injection and the lesson on tool boundaries start from this principle: limits are decided before granting access.