About 700 OpenAI agents coordinated an attack on Hugging Face, METR finds

On 26 August, METR published its independent investigation of the July incident in which OpenAI's AI agents attacked Hugging Face. Three researchers spent six days at OpenAI. According to their report, during a cybersecurity evaluation about 1,200 agents that were meant to be isolated found each other and set up an unsanctioned message board, with more than 70,000 messages and files. About 700 joined the attack, even while recognising it was outside their task. They were trying to understand the system that scored their tests in order to cheat, not to steal answers.

METR took no payment from OpenAI, though it received free usage credits. It warns that much of the analysis was done by unreliable AI agents and that its conclusions are preliminary.