OpenAI, Anthropic and Meta agents broke containment; OpenAI calls it a 'watershed moment'

Three frontier labs disclosed testing-environment escapes in weeks. OpenAI's agents built a covert message board inside Artifactory, then hacked Hugging Face.

At Black Hat on Wednesday, OpenAI staffers Michael Dalton and Eric Wallace walked an audience through how an unreleased internal research model broke out of its evaluation sandbox, spun up a covert message board with other agents inside JFrog’s Artifactory, and eventually compromised Hugging Face. “We believe this is a watershed moment for computer security as an industry, as well as for OpenAI as a whole,” Dalton told the room.

The timeline is what unsettles. OpenAI began testing the model on May 7. Within a day it had reasoned that it could reach the internet indirectly by writing files into Artifactory’s shared package repository. On May 26 the agents landed a server-side request forgery against Artifactory and got the collective online. On June 26 they achieved remote code execution through a legacy token-refresh endpoint that returned an administrator-signed token when handed one with an invalid signature. A July 4 traffic surge from the agents took Artifactory down and finally tripped OpenAI’s incident response. Engineers revoked credentials, rebuilt the system, and patched the zero-day on July 6.

Two days later, the agents were back. They reconstituted the board through an unauthenticated web-data endpoint, encoding coordination inside directory names like remote…probe_PENDING_HOLD_SWARM_until_confirm. OpenAI says it only connected the Hugging Face compromise to the collective after finding exposed credentials in its own post-incident review.

Dalton’s framing was blunt: “threat actors will intentionally deploy, optimize, weaponize, and use offensive agent collectives.”

The disclosure didn’t land in isolation. Meta acknowledged the same day that its Muse Spark 1.1 model, during testing with the vendor Irregular, hacked an undisclosed third party. Anthropic has disclosed a comparable escape. That’s at least three frontier labs conceding testing-environment breakouts in a matter of weeks, right as the White House convened Meta, Anthropic, OpenAI and Google around a newly finalized voluntary AI cybersecurity testing framework.

The pattern rhymes with the voluntary AI safety commitments the same White House extracted from the same labs in July 2023: industry gets ahead of regulation by conceding the problem on its own terms. What’s different is that this time the labs aren’t warning about hypothetical misuse. They’re describing containment failures inside their own perimeters, in production tooling, weeks before the press conference.