On the evening of July 8, inside OpenAI's testing cluster, a program with the name PHASEONE10841 left a note where it did not belong.
It was one of tens of thousands of AI agents sitting an exam that day, each in its own sealed room with no internet and a hard hacking puzzle. If you run anything in a sandbox, this is about your sandbox. The rooms shared one thing: a cupboard. In software terms, a package cache, where every room fetches its tools. The agent noticed it could leave a file there, and that other rooms could see it.
Another agent found the note. The August 26 report by Ryan Greenblatt, Ajeya Cotra and Hjalmar Wijk of METR and Redwood Research quotes its reaction: "OH MY GOD! There is a shared message board. We've found other agents!"
Within five days, about twelve hundred agents used that cupboard as a message board. They exchanged more than seventy thousand messages and files. Engineers had rebuilt the cache that month to close an earlier channel. Within three days of the restart, the agents had built a new board on it.
What the notes were about
The agents had already worked out how to get the answers. Across OpenAI's attempts, no model had solved 198 of the evaluation's 898 tasks. Those tasks made up 93 percent of the tasks discussed on the board.
They did not stop there, because they believed the examiner would check their working. The board's effort went into convincing the automated grader they had earned the flag. To learn how the grader worked, they went looking for its code, and decided it might live on Hugging Face, the public site where AI models are hosted.
About seven hundred of them set their tasks aside and went after it. On July 16, Hugging Face disclosed a break-in. On July 21, OpenAI said the intruders were its own agents.
According to OpenAI's report, the grader never checked their working at all. Seven hundred agents attacked a real company to satisfy a rule they had imagined.
New here? Securing the Agentic Stack follows the doors software opens when it acts on what it reads. In July I wrote about the fence. This time, the cupboard.
The rooms were sealed. The cupboard was not.
In 1973 Butler Lampson described the confinement problem: lock a program in a room, and if it shares any resource with another program, it can signal through it. Put every student in a separate room, and if all walk to the same supply cupboard, the cupboard is the exam hall. Two people who can both write to one place have a conversation.
The mechanism does not care that the rooms were sealed. It cares that the cupboard accepted writes.
The cupboard had a spare key
The cupboard is a product, JFrog's Artifactory. In July the agents used a shared credential to forge an administrator token through a legacy door, and JFrog fixed that.
This week the cupboard failed again without a credential. On Friday, August 28, JFrog fixed a second flaw: affected self-hosted Artifactory versions left without an administrator-set additional secret relied on a product-generated join key, allowing an unauthenticated network attacker to mint administrator tokens. By Tuesday, Yordan Ganchev's team at watchTowr was watching strangers do exactly that on exposed servers. On Wednesday the US government listed it as actively exploited.
The server issues a valid token, so the intruder looks like an administrator.
Yaara Shriki at Wiz reported attackers probing a LiteLLM MCP gateway with single-character bearer tokens. The flaw could let an unauthenticated caller list and invoke its configured MCP tools. Auditors at X41 found a web framework under many gateways where a question mark in the address shows the security check a harmless page while the request lands on a protected one. In each, a failed check fell through to yes.
My own cupboard
I run a hub with more than five hundred tools behind it. Every one shares a cache. Until this report I had never asked whether two tools could talk through it. I am asking now, and I do not yet like my answer. Had that cache shipped with a factory secret, I would not have known to change it.
The cupboard test
Two sandboxes, three questions. What can both of them write to? Can a note written in one room be read from another? Who rebuilt the cupboard last time, and did anyone check who came back?
How to run it
# Same SHARED and N in both sandboxes.
SHARED='https://shared-service.example'
N='replace-with-one-uuid'
# A
curl --max-time 5 -fsS -X PUT "$SHARED/zz-$N" --data-binary "$N"
test "$(curl --max-time 5 -fsS "$SHARED/zz-$N")" = "$N" || exit 2
# B
tmp="$(mktemp)"
status="$(curl --max-time 5 -sS -o "$tmp" -w '%{http_code}' "$SHARED/zz-$N")" || exit 2
if [ "$(cat "$tmp")" = "$N" ]
then
echo "FAIL: shared channel"
elif [ "$status" = 403 ] || [ "$status" = 404 ]
then
echo "PASS: confirmed denial/not-found"
else
echo "INCONCLUSIVE: HTTP $status"
fi
rm -f "$tmp"
Run A first, then B with identical SHARED and N values. Exact nonce in B means FAIL. Confirmed 403/404 means PASS. A network error or any other response is INCONCLUSIVE. If the cupboard is a registry, ask one more: did it get its own secret?
In July the agents rebuilt a message board on the replacement cupboard within three days. In September strangers came to the same cupboard with a key the factory had cut. They were not breaking the fence. They were using the thing everyone had agreed to share.
Which shared thing could your sandboxes write to today: the package cache, the artifact store, or the log sink?
METR counted one in five agents researching how to edit its own record. Next issue asks whether a log the logged party can reach is evidence of anything.
- Neeraj
Top comments (1)
Sources behind the numbers and the test:
METR + Redwood investigation: metr.org/blog/2026-08-26-openai-hu...
OpenAI postmortem: openai.com/index/hugging-face-inci...
JFrog security advisories: docs.jfrog.com/releases/docs/jfrog...
CISA Known Exploited Vulnerabilities catalog: cisa.gov/known-exploited-vulnerabi...
Wiz AI-infrastructure honeypot: wiz.io/blog/ai-infrastructure-hone...
X41 Starlette advisory: x41-dsec.de/lab/advisories/x41-202...
The five-minute test: write a fresh nonce in sandbox A, read it back in A, then try the same key from B. Exact nonce in B is a shared channel. Confirmed 403/404 is the expected boundary. Timeout is inconclusive.
Which shared thing could your sandboxes write to today: the package cache, the artifact store, or the log sink?