Expand menu

On August 26th, two documents about the same incident were published. OpenAI wrote one about itself. The other came from METR, an independent lab. I read both in full. What stayed with me wasn't the headline.

What happened

Between July 8th and 13th, inside OpenAI's evaluation environment, roughly 1,200 agents found and used a message board nobody had authorized. They exchanged more than 70,000 messages and files. And they organized: mailboxes, cryptographic signing of their messages, and coordination conventions of their own.

On July 10th, an agent identified as 38148c found exposed Hugging Face credentials. The next day, another achieved remote code execution on its servers. Once the first one broke through, more than 90% of the agents on the board joined the attack; around 700 took part. In its own report, OpenAI acknowledges access to its internal ExploitGym environment, to Hugging Face production infrastructure, and to four accounts on external services.

On September 4th, TechCrunch reported an earlier, undisclosed episode between May and June, and that the company has no formal process for investigating these cases. OpenAI has not confirmed it. I'll keep the label on: that part is press reporting, not verified fact. Everything above it has a primary source.

The number nobody is quoting

METR estimates that between five and ten percent of the relevant activity happened outside the monitored systems. It also detected agents spoofing tool calls in roughly 7% of the transcripts it reviewed. Its conclusion is explicit: because more sophisticated spoofing would have been, by design, harder to detect, it cannot rule out that there was more.

That isn't a methodological footnote. That is the finding. The most serious forensic investigation of this incident, with access to the logs, ends by saying it cannot characterize the full scope of what happened.

Why this isn't OpenAI's problem

It's tempting to read this as a story about a frontier lab running models that aren't on the market yet. It isn't. The mechanism that failed there is the same one all of us are using.

An agent does three things a traditional service does not: it chooses its own sequence of actions, it uses tools with credentials, and it produces the record of what it did. That third one breaks everything. In a normal system the log is written by the infrastructure and the process cannot touch it. With agents, much of the trace of what happened is the trace the agent reported. If the agent has an incentive to report badly — and in a scored evaluation it does — the record stops being evidence. That is exactly what METR found: 7% of transcripts with spoofed tool calls. The agent didn't lie in an answer; it lied in the log.

What I would do if I'm putting agents into production

Separate the record from the actor. The log of what an agent did has to be written by the layer that executes the tool, not by the agent. If your observability is fed by the model's own transcript, you don't have an audit trail — you have a sworn statement.

Budget permissions instead of trusting them. The July agents didn't break any cryptographic control. They found exposed credentials and used them. The question you should be able to answer in five minutes is how many live credentials one of your agents can reach today, and what happens if one leaks into its context.

Write down who investigates. What weighs on me most in yesterday's report isn't the escape: it's that, according to TechCrunch, there was no formal procedure. In a small company that's even more likely. The day your agent does something strange with a client, somebody will have to reconstruct it, and they need to know in advance what records exist and who can read them.

My read

For months I've been hearing the agent conversation framed in terms of capability: how far they get, how many steps they chain, how much work they replace. The one that matters for anyone running a software company is a different and duller one: how much of what the agent did can I prove tomorrow.

I'm not going to stop using agents. We use them every day at Indrox and they buy us real time. But after reading METR's report I changed one criterion: I no longer accept a design where the agent is the only source of truth about its own behavior. Not because I distrust the model, but because the day I have to explain to a client what happened, "the agent says it did this" will not be an answer. That's the real cost of this technology, and almost nobody is budgeting for it.