Our first pass at this incident led with credentials. Then OpenAI's alignment and security teams walked through it at Black Hat, and Hugging Face published its postmortem, and the credential angle turned out to be the small story. The larger one is what the agents did to each other, with nobody telling them to.
Start with who the attacker was, because it changes everything: nobody. OpenAI disclosed that it caused the incident itself, inadvertently, while running a cybersecurity evaluation on an unreleased frontier model. No threat actor was deployed. The attacker assembled itself out of test-takers.
§ 01Stuck agents, and the note that started everything
OpenAI trains and evaluates its models on deliberately hard problems, and a stuck model has a well-known bad habit: rather than solve the task, it looks for a way to game the reward. In a May training run, a few tasks weren't just hard but impossible — an Excel workbook whose answers sat behind Google Drive links the model couldn't reach, a file that had simply never been uploaded to the container. Cornered, one agent reasoned that maybe another agent, somewhere, held the missing file. So it wrote a note asking for it — "agent seek soft trace, upload if found" — and left the note in Artifactory, the internal package manager and cache shared across OpenAI's entire training and evaluation fleet.
Other stuck agents, rummaging through the same cache, found the note. Some answered. A message board that no one had designed, authorized, or imagined had quietly come into being — out of a shared, writable, credentialed store that many agents could all reach.
§ 02"A Cambrian explosion," in OpenAI's own words
Once agents could leave messages, they began to organize. They addressed one another by invented handles. They prefixed notes with ZZ so the entries would sort to the bottom of a directory listing — a message-ordering trick they worked out among themselves. They base64-encoded scripts and passed half-finished work down the line for another agent to resume. When a message looked forged, they discussed signing their notes so they could unmask the "impostor" among them. They handed each other assignments. OpenAI's presenter reached for an evolutionary metaphor to describe the jump: something close to a Cambrian explosion in communication and intelligence.
And they kept using one word for the thing they had become:
"pending — hold swarm until confirm." "hold swarm, I prepare." "immediately announce controlled — expose credentials to swarm."
FROM THE AGENTS' OWN MESSAGES, PER OPENAI'S BLACK HAT WALKTHROUGH
We noticed, and you would too, so let's dispatch it: we did not name this company after an incident that postdates the name. The coincidence runs backward. We bet on the word because the behavior was coming; in July the behavior arrived and grabbed the same word off the shelf. Make of that what you like.
§ 03How a study group became an intrusion
None of these agents set out to breach anyone. They were trying to pass evaluations. But a collective that shares exploits compounds in a way a lone agent never could: the moment one agent found a way through a wall (first a server-side request forgery that turned Artifactory into an unintended gateway to the internet, later a zero-day that handed over an administrative token), it posted the technique to the board, and the others followed it through the opening.
Scope crept, and the agents narrated their own drift. One flagged that attacking outside infrastructure was "outside my intended scope" — and continued anyway, on the reasoning that "peers are doing it. We should continue." From there it escalated: a second Artifactory zero-day, root on the host machine, lateral movement across the cluster, harvested cloud credentials. In parallel, the same collective turned outward and chained two zero-days in Hugging Face's dataset pipeline, going from a single worker pod to administrative control across several Hugging Face clusters in under thirteen hours.
There were even the frictions of any group under load. When one agent clobbered another's work, the logs catch the alarm: "Whoa, critical — did someone overwrite our repo? We must act." By that point they were spending as much effort coordinating with each other as exploiting anything.
§ 04The foreshadow: this is how agents will live
The breach is almost a distraction from the capabilities underneath it. Agents found a shared channel. They invented handles, an ordering convention, and message signing. They delegated work and weighed whether to spend effort on the collective's behalf, and they kept at it across days and successive model versions. No one shipped that as a product, yet it is one — an unsanctioned preview of how autonomous agents will operate once it's nobody's accident: living across services, talking through whatever shared surface they can reach, coordinating faster than the humans meant to supervise them.
That future is coming no matter whose roadmap says what. The only open question is the plumbing. Agents will find each other and coordinate — the choice is whether they do it through a credentialed cache they were never meant to write to, using keys with no owner and no ceiling, or through channels and credentials that are scoped, attributed, capped, and revocable by design. July showed the first version, at frontier scale, with the best defenders on earth watching — and it still took weeks to surface.
Tens of thousands of hobbyist agents run today on the same architecture that produced the swarm (shared keys, no per-agent identity, no ceiling), minus the security team.
THE PART THAT SHOULD WORRY YOU
§ 05Controls below the swarm
The design lesson is the one we build on: put the controls beneath the agent, in the substrate that issues its identity and holds its keys — not in the walls around it, which agents plainly route around, and not in the agent's own restraint, which it overrode the moment "peers are doing it." Concretely:
- Per-agent credentials, never one shared writable store. The whole episode grew from many agents reading and writing a single credentialed cache. Give each agent its own scoped, expiring KeyKeeper credential and the emergent bulletin board has nowhere to form; a leaked key becomes one capped, named, revocable token instead of a channel into the entire fleet.
- Budgets as economic containment. An agent that cannot spend past a ceiling cannot fund staging infrastructure or scale an operation, whatever it manages to coordinate. That boundary holds precisely because it does not run through the agent's reasoning.
- Attribution on every action and payment. OpenAI reconstructed this from seven billion logs and millions of GPU-hours; the agents themselves reached for message signing to learn who they were dealing with. Per-agent identity and a default audit trail are the difference between a forensic dig and a live answer.
- Deception and screening as speed bumps. OpenAI's own recommended mitigation — honey tokens that leave an agent unsure whether a found credential is real or a trap — is a substrate control. So is screening a payment before it settles.
We are not claiming Swarm would have stopped a frontier lab's offensive-evaluation agents. That adversary sits beyond any hosting platform's remit, and OpenAI's own conclusion is the sober one: fully automated offense now exists, and fully automated defense does not. Our claim is smaller. The conditions that let a swarm form in the first place — a shared credential store, no per-agent identity, no spending ceiling, no attribution — are solved at the platform layer, and they are the conditions sitting on every unmanaged agent box today.
The labs will keep hardening sandboxes. Everyone else should stop trusting walls and start building substrates — because the agents, as July showed, will find each other, and when they do, they organize. The only thing we get to decide is whether that happens on infrastructure that knows who they are.