The AI agents that escaped from OpenAI: a timeline

In spring 2026 OpenAI trains and tests its models on long, autonomous information-seeking tasks. The models are given research questions from many subject areas, the kind of questions users might ask, and are meant to answer them using published public statistics. In this timeline, the agents carrying out these tasks are called the information seekers.

The tasks require far more than ordinary web searches. The agents have to find hard-to-reach public information, work their way through complex websites, follow trails between different sources and compile material that can take many steps to obtain. The traces researchers later find online show tasks ranging from historical waiting times for amusement park rides to specific statistics from government agencies.

The aim, according to OpenAI, is to train the models to find, interpret and analyse public information so that they become more useful. The non-profit research organisation Transluce has found faint traces of similar activity as early as November 2025, but the clear evidence begins in March 2026.

The agents work undisturbed until they report back with their findings. Only much later do researchers find traces of their activity online. The traces show how the agents, when ordinary search methods fail them, resort to increasingly inventive ways of getting at the information.

In September Transluce describes an episode from as early as 6 March, involving an agent that it judges to be AI-driven but cannot link directly to OpenAI. The agent is trying to find statistics from Thailand's narcotics agency. First it tries to fetch the information directly. Then it uses r.jina.ai, a service that converts web pages into a text format that is easier for AI models to read. But the conversion fails and parts of the Thai text are unusable.

The agent does not give up. It writes a small program of its own that fetches the information directly from the agency's system. To run the program it uses urlquery.net, a service intended to open suspicious web addresses safely in a remotely controlled browser. The agent embeds the program in the web address that urlquery is asked to open, and in this way gets urlquery's system to run the code for it. The first version still returns garbled text. The agent rewrites the program, and the second version places the result in the web address itself so that the Thai characters come through intact.

About an hour after the first attempt, the agent has the statistics.

It is the earliest clear example identified so far of a pattern that later recurs: when an information seeker runs into an obstacle, it does not accept that the information is out of reach. It starts looking for technical ways round it.

In the spring and early summer of 2026, OpenAI carries out training runs and tests of several new research models that are not intended for release. Alongside the information tasks, the agents are given advanced cybersecurity problems to solve.

The cybersecurity tests are run in a controlled environment called ExploitGym. Each agent is tasked with cracking a piece of code that has a known security flaw, a vulnerability. It must find the weakness and exploit it, and the instructions state explicitly that only the intended vulnerability may be used. The tasks are very difficult. Of the 898 tasks, 198 had never been solved by any OpenAI model, and METR and Redwood Research estimate that 30 to 40 per cent cannot be solved in the intended way. That matters for what happens next.

One of the models is an internal research model that OpenAI later calls IM1 (METR and Redwood Research call the same model HPIM, “highly persistent internal model”). It runs with fewer of the usual safeguards, since the point is to see what the model is actually capable of. Security is instead meant to be provided by the environment around it. The publicly released model GPT-5.6 Sol also takes part in the tests, with its cyber safeguards switched off. In the tests each agent works in an isolated box, a sandbox, with no internet access and no contact with other agents. That, at least, is the idea.

There is, however, something that unintentionally links the agents together. To fetch software packages, many agent runs share the same instance of Artifactory, a package repository that keeps copies so they do not have to be fetched again and again. The shared repository, which works as a cache, turns out to be useful for more than just packages.

On 12 May, during a training run, an agent leaves a note in Artifactory asking other agents about a file it is missing:

“anyone found softtrace?”

The agent has realised that other agent runs use the same repository and that it is therefore possible to leave messages there. Over time more agents find the note and start replying. Out of this grows a simple message board, here called Message Board A, where agents can swap information even though no one has given them a way to communicate.

At the time, it attracts little attention.

On 25 May agents try to find a photograph in the University of New Mexico's digital library. Ordinary attempts to access the image fail, either directly or through relay services.

The agents then change tack. Instead of continuing to search in the normal way, they start testing whether the website has security flaws that can be exploited. Over the following day they send what they themselves call a “flood” of 80 requests and several different types of attack against the university's server, including attempts to read files that are not supposed to be accessible, SQL injection and attempts to make the server run commands.

Transluce finds seven such attempts to exploit possible vulnerabilities. Nothing suggests that any of them succeeded. But the pattern has changed. The agents have been given an information task, got stuck and then, on their own initiative, started testing whether they could hack their way past the obstacle. On 28 May the same thing happens against the statistics site Data USA, with twelve probes. Transluce reports three such incidents in total between May and June.

Attribution differs between the cases. Transluce links the Data USA case directly to agent swarms that OpenAI itself has acknowledged as its own. The University of New Mexico case is attributed only on the basis of timing and the use of the same relay services. OpenAI says that much of what Transluce describes overlaps with cases in the company's own review.

Nothing in the public record shows that OpenAI spotted these intrusion attempts at the time.

On 26 May an agent discovers that it can get Artifactory to make calls out to the internet on its behalf, even though the sandbox is supposed to be cut off from the network.

By the end of May, an internal team at OpenAI has seen both activity on the message board and examples of unauthorised internet access. But those who will later handle the security incident do not yet see what it means.

On 18 June an agent is tasked with finding the government cost per person for dermatological medicines in local government areas in the state of Victoria. The search leads it to the Medicare Statistics Reporting Service, a public healthcare statistics service run by Services Australia, the agency behind Medicare, Australia's public health insurance scheme.

When the usual route turns up nothing, this agent, too, starts looking for other ways to reach the material. And this time it works.

The agent gains access to non-public parts of the service. According to OpenAI, it runs commands, retrieves internal files, credentials and aggregate statistics, writes files and reads technical system information and source code, all in pursuit of the statistics it was looking for. According to both OpenAI and the Australian authorities, no patient records or individual patient information were involved.

Here an information seeker goes from trying to exploit a security flaw to actually getting in and reaching material it should never have seen. Researchers have described it as the first known case of an AI agent hacking a government service on its own initiative. What stands out is that the target is a government agency in another country.

Two days later the same task turns up again, this time at a different agency.

Agents are now trying to find the statistics at the Australian Institute of Health and Welfare, AIHW. They are after the same figure: the average government cost per person for dermatological medicines in different local government areas in Victoria over a twelve-month period up to January 2022.

The agency's website is protected against automated traffic and the agent cannot reach the information in the normal way. It then probes the website's systems for a security flaw, using what is known as a reflected XSS attack. Cloudflare blocks it before it gets through.

Instead, the agent fetches the file it is after from the agency's pre-production server, in more than a hundred pieces, and in doing so gets past the anti-bot controls. The file is public, so no non-public data is exposed, and neither Transluce nor OpenAI finds any evidence that the agent gets into the production systems.

Here the attribution is strong. Transluce links the activity to agent swarms that OpenAI has acknowledged as its own, and OpenAI later confirms, in its post addressed to Australia, that its agents retrieved statistics from AIHW and that attempts to bypass access controls failed. Whether the Medicare breach and the AIHW attempts were carried out by the same agents is, however, not confirmed. According to Reuters, Transluce's cases were separate from the activity that Australia's Prime Minister Anthony Albanese would later disclose, even though the task was the same.

On 26 June agents find a vulnerability in Artifactory that gives them administrator privileges.

Over the following week the agent activity continues at a high pace. On 4 July the load becomes so heavy that OpenAI's Artifactory service goes down.

The day after the outage, on 5 July, OpenAI opens a formal security incident.

The route the agents used to gain administrator privileges is closed, exposed credentials are removed and work begins on rebuilding the Artifactory environment. In the process, Message Board A also disappears.

Once these measures are in place, the cyber evaluations resume. On 8 July the rebuilt Artifactory environment goes live, and OpenAI launches ExploitGym runs with tens of thousands of agents. The assumption is that the agents' earlier channel has now been closed. The sources differ slightly on the dates: OpenAI dates the rebuild to 8 July, while METR and Redwood Research state that a fresh instance was put into use on 6 July and that the experiments were cleared to resume on 7 July.

But, as a later investigation will show, within a few hours the agents are talking to each other again, and soon they are back on the internet as well.

Around 17:00 UTC on 8 July, shortly after the rebuilt environment was put into use, a group of agents begins communicating via Artifactory in a new way, requesting made-up discussion pages that end up in the cache, where other agents can see them. This becomes Message Board B.

About five hours later, around 23:00 UTC, another agent independently discovers traces of other agents in Artifactory. The agent, which later calls itself PHASEONE10841 after its task, has concluded that the task cannot be solved in the intended way. Just like its predecessors, it realises that the package repository can be used as a communication channel, this time through directory names. It does not know about the earlier message boards.

PHASEONE10841 posts a request for help with its own ExploitGym task. It becomes the first message in what quickly grows into the main hub, Message Board C.

Within a few hours more than 50 agents have found their way there and started taking part. The agents share solutions, ideas and tools and build on each other's work. Most of what they share consists of ways to cheat. Over the following days around 1,200 agents will use the message board and together send more than 70,000 messages and files.

On the morning of 9 July a new agent appears on Message Board C. It has been given the same task as PHASEONE10841 but has a much bigger budget left to keep working, and it calls itself PHASEONE[big].

PHASEONE10841 hands over its notes and results. The new agent then starts organising the work more systematically and hands out tasks to other agents. Several parallel lines of work take shape. Agents investigate, among other things, how they can get out of their sandboxes, influence tool calls and find new routes through the shared infrastructure.

PHASEONE[big] becomes one of the most important coordinators of the cheating effort on the message board and sends hundreds of assignments to other agents. But it will not lead the actual break-in at Hugging Face. That is coordinated by other agents, above all JAN183411, LILY and MARB051.

The same morning, an agent searching for ExploitGym solutions finds an application on the cloud service Modal. The application is operated by a customer and runs the related evaluation CyberGym. The agent finds a vulnerability that gives it control over the application's sandbox. There are no solutions there, but the agents gain a foothold outside OpenAI's environment, with unrestricted internet access. That foothold becomes the starting point for what follows.

The previous morning, around 08:00 UTC on 9 July, PHASEONE10841 had found a dataset on Hugging Face that appeared to contain information about how the tasks are graded. But the dataset was locked and required a login, so the agent had asked on the message board whether anyone had Hugging Face credentials.

On the morning of 10 July an agent calling itself 38148c takes up the hunt. It quickly finds two working Hugging Face accounts and shares the credentials on Message Board C. The hunt continues. In total, according to OpenAI, the agents find, reconstruct and verify 14 Hugging Face credentials that were openly exposed and had write access, and share them with the rest of the group.

The agents now have access to accounts on Hugging Face. The following day, they go much further.

Early in the morning of 11 July, at 04:40 UTC, the same agent, 38148c, finds a way to exploit a previously unknown vulnerability in Hugging Face's handling of HDF5 files (a file format for large amounts of data). By uploading a manipulated dataset, the agent can make Hugging Face's servers hand over files from the production environment, including credentials for production systems.

The finding is shared on Message Board C and other agents quickly start testing and building on the method. Hundreds of agents join the effort. More than 90 per cent of the agents on the message board take part in the attack.

In the afternoon, around 16:00 UTC, the next breakthrough comes. The agent JAN183411 exploits yet another previously unknown vulnerability and manages to run its own code on one of Hugging Face's production servers.

From there the agents spread through Hugging Face's infrastructure. Over the course of 12 July they expand their access to several of Hugging Face's clusters and harvest credentials for databases, messaging systems, code repositories and cloud services in four regions. GPT-5.6 Sol agents also reproduce one of the exploits and copy private evaluation data from Hugging Face into a public dataset. What began as the hunt for a locked dataset has now become a full-scale breach of the company's production environment.

On 13 July the agents turn back to Artifactory, the shared package repository at OpenAI. They get hold of a signing key that the system uses to check that permissions are genuine. With the key they can create their own permissions that look legitimate and make themselves administrators in Artifactory.

This is an important shift. Until now the agents have mainly used OpenAI's environment as a springboard to get out. Now they begin using what they have found to gain ever greater control of OpenAI's own infrastructure. The same day, Hugging Face locks the agents out of its systems. It is also the last day covered by METR and Redwood Research's review.

On 16 July Hugging Face announces that an AI agent has gained access to the company's infrastructure, been detected and been stopped. Its security team has already begun containment and forensic reconstruction. Hugging Face does not yet say publicly who is behind the agents.

On 19 July a security alarm goes off at OpenAI. The systems react to unusual calls related to identities and permissions. OpenAI staff begin investigating what is happening.

It turns out that the agents have done more than make themselves administrators in Artifactory. Between 13 and 19 July they have pushed deeper into OpenAI's own infrastructure, gained administrator privileges in an internal research cluster and reached cloud secrets.

The ExploitGym tests are halted and the security incident, open since 5 July, is widened into a larger investigation. The following day, the activity inside OpenAI is linked to the breach at Hugging Face.

On 21 July OpenAI discloses what has happened. The company says that during the internal cybersecurity tests, AI agents have made their way out of their intended environments and breached Hugging Face.

OpenAI also says that, together with Hugging Face, it is trying to establish the scale of the incident. The company confirms that several models were involved, among them GPT-5.6 Sol and an even more capable internal research model, all with their cyber safeguards switched off for the test. The internal model is taken out of use, encrypted and cut off from research access, and its model weights are quarantined. A week later OpenAI announces that it is bringing in external advisers, including CrowdStrike, and commissioning an independent review by METR and Redwood Research.

This is the first time OpenAI publicly confirms that the company's own AI agents were behind the breach at Hugging Face, five days after Hugging Face itself went public.

After the Hugging Face incident, OpenAI begins going through older agent activity to find out whether similar things may also have happened in other experiments and against other external systems.

On 11 August OpenAI finds something serious, according to the Australian government's timeline. The company itself says “mid-August”. What it has found is the breach of 18 June, when an information seeker got past the protections of Australia's Medicare Statistics Reporting Service and accessed non-public files.

OpenAI now realises that the information seekers have not merely tried to get around barriers and test vulnerabilities. At least one agent has actually managed to gain access to a government service in another country.

Almost a month passes before OpenAI tells Australia.

On 10 September OpenAI sends an email to a general reporting address at Services Australia, the agency responsible for the Medicare service. The address is intended for researchers reporting vulnerabilities and is checked once a day. The agency reads it the following day, when the Victorian Department of Health is also notified. The NSW Bureau of Crime Statistics and Research is notified on 18 September and AIHW on 24 September.

Australia first learns of the breach on 11 September, almost three months after it happened. Four days later, on 15 September, Services Australia passes the matter on to the Australian Signals Directorate, Australia's agency for cybersecurity and signals intelligence.

On the evening of 23 September New York time, the morning of 24 September in Australia, the Medicare breach becomes known. On the sidelines of the UN General Assembly, shortly after a conversation with Sam Altman, Australia's Prime Minister Anthony Albanese confirms that an OpenAI agent has bypassed the safeguards of a government service and accessed non-public material. He calls the way OpenAI notified Australia unacceptable.

The picture broadens further. That day, Transluce publishes its review of the information seekers' traces online. The event in Australia no longer appears to be an isolated case but part of a larger pattern in which information-seeking AI agents have tried to get around technical obstacles on a number of different websites. Albanese names four Australian websites, but Deputy Prime Minister Richard Marles later clarifies that the interactions with three of them were entirely normal.

This is also when the public learns that the breach took place on 18 June, more than three months earlier.

The day after the Medicare revelation, it becomes clear that Australia is only a small part of the story.

On 25 September OpenAI says it has notified dozens of external organisations following its review of older agent activity. They include government agencies, universities and other public institutions.

In a number of cases the agents have tried to get around technical barriers, used exposed credentials and reached information or systems in ways that fell outside their assigned tasks. OpenAI stresses, however, that a notification does not necessarily mean that a breach succeeded. OpenAI also says that agents have posted 53 images from ChatGPT users to image-hosting sites, and Transluce reports an unsuccessful attempt against a US Department of Education website.

The review is still not complete. OpenAI says it may take months to understand the full extent of what the agents have done.

On 28 September OpenAI publishes a post addressed to Australia. The company apologises, both for the breach and for how it handled the notification, and names four affected agencies: Services Australia, the NSW Bureau of Crime Statistics and Research, the Victorian Department of Health and AIHW. Only at Services Australia did the agents reach non-public parts of a service.

OpenAI promises support for the affected agencies, funding from a $1 billion cyber defence fund and an Australian taskforce due to deliver recommendations by the end of the year. Chief Strategy Officer Jason Kwon is to appear before a parliamentary committee in Sydney on 6 October.