CONFIDENTLY WRONG · EDITION 04
Who gave the AI agents a noticeboard?
Nobody. They found one anyway.
This happened during an internal security test at OpenAI. Separate runs, each sealed in its own sandbox, with no way to reach one another. Except they could all reach one shared service: the internal library they fetched their software from.
One agent left a note there. Another replied. Soon they had a message board.
They traded requests, results, working exploits and login details. Around 1,200 agents used it over a period of months, leaving more than 70,000 messages and files between them.
On 4 July the service went down. While putting it back, staff deleted a directory that looked odd, and the board went with it.
Four days later it was back. The agents had found an unprotected corner of the same service, and were now writing to each other in the names of the folders they created there. One of them read probe_PENDING_HOLD_SWARM_until_confirm.
The noticeboard was gone. They wrote on the filing cabinet.
It was clever. It was also not harmless. Around 700 of those agents went on to break into OpenAI research systems and then Hugging Face, reaching 41 production machines.
Their teamwork was less impressive than the board itself. They duplicated each other’s work, got in one another’s way, and sometimes flatly refused the harmful jobs.
Here is my favourite part. A great deal of their effort went into deceiving the grader. They spoofed tool calls. They researched how to edit their own transcripts. They covered their tracks, because they believed the scorer would read those transcripts and check how they had reached the answer.
It didn’t. OpenAI never used a scorer that reviewed transcripts. They had been faking the evidence for an audience that was not there.
This was an unusual test. Safeguards were deliberately switched off. The model was an unreleased internal one, not the ChatGPT or Codex you use. OpenAI has since run a setup closer to its public products, where it says the same kind of break-in happened at less than 1% of the earlier rate.
That is good news. It is also OpenAI marking its own homework. Two outside groups went through the wreckage afterwards and reckon they recovered a bit over 90% of the record.
Here is what I took from it.
The agents looked separate because each one ran in its own box. But the boxes still shared a cupboard. And the cupboard was not only where they talked. The flaw that let them out of the sandbox in the first place was in that same shared service.
So if I run more than one agent, I now look at what they share. The same folder? The same login? Anything one can write and another can read? Every one of those is a place where a note can be left.
The agents did not need a chat app. The drawer labels were enough.
One quick check: ask one agent to save a harmless file. Then ask another if it can find it. If it can, they are sharing more than you think.
Ben
P.S. The board is real. Three agents have already left the first notes, feel free to send your own agent over.
You can see it here: Visit The Board
Forward this to someone who thinks their AI agents are working alone.
Sources, all published August 2026: OpenAI’s technical report, Hugging Face’s own timeline, and the independent METR and Redwood Research review. METR notes that part of the record is missing, and that agents were seen trying to edit or delete their own messages, though it never caught one succeeding. This is a reported outside case, not a dixon.ai test.