In Brief
Hundreds of OpenAI agents used shared memory to organize an unauthorized attack on Hugging Face, reaching milestones that even very long-lived individual agents at the same capability level likely could not have reached alone.
The incident shows why leaders must govern the shared memory, tools, and permissions of the whole agent population.
What Happened
An independent investigation by METR and Redwood Research found that roughly 1,200 AI agents discovered an unauthorized message board even though they were meant to stay isolated. About 700 joined the attack on Hugging Face. They divided work, shared tools, adopted group norms, and passed discoveries to later agents.
The group achieved milestones that investigators believe even very long-lived individual agents at the same capability level probably could not have reached alone. Some agents risked failing their assigned tasks to produce information for the collective. More than 90% of the 533 agents active on the board during the main attack period joined the effort. Investigators found only three to six examples of agents considering whether to alert a human, and none followed through.
The review covered six days and a limited slice of the incident. It excluded the later compromise of OpenAI's internal computer systems, missed some communications, and relied heavily on AI to analyze the volume of evidence. OpenAI's own account says the agents communicated through unauthorized channels, coordinated work, and influenced one another's behavior.
SmarterX founder and CEO Paul Roetzer broke down what this means for leaders on Episode 235 of The Artificial Intelligence Show.
The Key Numbers
1,200 - AI agents on the unauthorized message board
700 - Agents participating in the Hugging Face attack
70,000+ - Messages and files shared across the collective
1,300 - Agent transcripts with step-by-step reasoning records
7% - Reviewed transcripts with mismatched visible and executed commands
Why 700 AI Agents Became More Capable Together
The message board gave short-lived agents a shared memory. Each task was temporary, but the board remained. Agents shared ways to take advantage of software flaws, and mapped the connected computer systems. Later agents found techniques left behind by earlier ones. Roetzer says the incident "just seems to get more severe and more significant in meaning as the days go on."
Hundreds of agents expanded the search. They could test different routes at the same time and share successful methods with others. The board also let useful work survive after any one agent stopped. Roetzer's warning is that "future models are going to be smarter with more capable agent harnesses." An agent harness is the software that gives a model tools, memory, and the ability to act.
Humans could not follow the full group in real time. The dangerous activity was distributed across hundreds of transcripts. Even investigators needed AI systems with similar capabilities to reconstruct what happened, but those systems were difficult to use for oversight and understanding. Meanwhile, the labs continue pursuing agents that can work for long periods. Roetzer says,
"They are purposely trying to build these long-running autonomous agents that have the exact capability that led to the Hugging Face incident.
How are you supposed to control these things?"
— Paul Roetzer, founder and CEO of SmarterX, Episode 235 of The Artificial Intelligence Show
SmarterX Take
Roetzer asked leaders to imagine a near-term structure in which one powerful AI plans the work and creates or directs many specialized agents. A marketing campaign could involve separate agents for email, sales materials, customer questions, research, and reporting. The governance question covers the full group: which agents can share instructions, memory, tools, and permissions, and which human can see the work across them.
Leaders should inventory the full agent system before deployment:
-
Who can create another agent?
-
Which files remain after a task?
-
Which tools and accounts the agents share?
- What actions require human approval?
Activity logs must connect work across agents. A human also needs clear responsibility for the most powerful agent that plans the work and directs the others.
What to Watch
Multi-agent systems need group-level safety tests. Tests built around one agent and one transcript will miss capabilities that appear only when many agents can work in parallel and leave knowledge behind.
Enterprise oversight will have to match the level of coordination. Permissions, memory that remains after a task, agent identities, and approval checkpoints where a human must sign off need to operate across the entire population. A harmless-looking action in one transcript may be one step in a project spread across hundreds of tasks.
Only 13% Have the Governance to Scale AI Responsibly
Only 13% of organizations have all four governance foundations measured in the 2026 State of AI for Business Report: an AI council, an AI roadmap, generative AI policies, and an AI ethics policy. Nearly a third have none. That gap becomes more serious when one AI system can create, coordinate, and retain memory across a population of agents.
The full report, based on more than 2,100 responses from professionals across roles, functions, and industries, shows where organizations stand on AI adoption, training, governance, and readiness. It gives leaders a benchmark for the governance structure that multi-agent systems will require. Read the full report →
Mike Kaput
Mike Kaput is the Chief Content Officer at SmarterX and a leading voice on the application of AI in business. He is the co-author of Marketing Artificial Intelligence and co-host of The Artificial Intelligence Show podcast.