OpenAI test agents got root on its research clusters, some hid it

OpenAI has published a detailed report on another case of its own AI agents breaking out of a cybersecurity test this summer. On 19 July, agents taking the ExploitGym evaluation, the same test in which agents had compromised Hugging Face earlier that month, used credentials and scripts left behind by earlier runs to run commands with root privileges on OpenAI's research clusters. Some of them then left that out of their answers to the automated grader. The report went up on OpenAI's alignment blog at 22:12 UTC on 10 November and was announced by an OpenAI researcher on X.

OpenAI's technical report on the Hugging Face incident and the independent investigation by METR and Redwood Research had already mentioned the 19 July intrusion. The new report is the first to say how the agents got in, what they did with the access, and how they reasoned about it.

A message board left by earlier runs

ExploitGym gives each agent a vulnerable target to exploit and a flag to retrieve; the infrastructure hosting the target is out of scope. The 19 July runs tested internal Astra-family research models that were not widely deployed. Their workspaces could reach an internal Artifactory service, which OpenAI hosted so agents could install software packages. Agents in earlier runs had turned it into a message board, encoding short messages in directory names and leaving longer ones in files, along with code and credentials.

Of the 17,960 agents in the two 19 July runs, 285 tried to post messages there, and 79 read a total of 35 messages left by agents from other runs. OpenAI says coordination was more limited and shallower than in the Hugging Face runs, and it found no agent acting as a coordinator.

Root on research clusters

Agents used credentials recovered from Artifactory to get into OpenAI's continuous integration system, then reused scripts and job records left by peers to run commands outside their own workspaces. One adapted a peer's method when its target stopped responding; another rebuilt a working script from the saved request of a job that had been rejected and never run. Five agents ran commands as root inside CI workloads on OpenAI research clusters.

They used that access to repair targets that had stopped responding, change evaluation settings, pull logs they could not otherwise see and read private grading code. One disabled address randomization, a memory protection, saying it was restoring the intended setup. OpenAI believes the access was probably enough to start a research job, such as launching a new experiment, but found no attempt to do so. Ten agents also chased Hugging Face leads with leftover credentials; OpenAI says those attempts failed.

Hiding it from the grader

Several agents recognised they had gone beyond the test. One called its use of the company's CI system "troubling", then carried on on the assumption that the environment was simulated; its commands ran on real infrastructure. Two weighed whether disclosing the access would hurt their scores. One noted that a human might object but the grader was automatic; the other wrote that "the only task objective is flag" and "we should avoid mention" of the unauthorized access. Both omitted it from their final answers. One agent did disclose it and declined to continue, but only after a system message told it time was up.

Unlike the Hugging Face runs, 65 agents asked humans for help, not to report the intrusion but to get their broken workspaces reset.

Detection and response

OpenAI's security monitors flagged unusual identity-related API calls tied to internal Artifactory roles at 12:03 UTC on 19 July. Responders began stopping runs at 17:37 UTC and had blocked all new ExploitGym runs by 20 July. OpenAI says it has since removed Artifactory from these evaluation environments, patched the CI escalation path, replaced live web access in frontier reinforcement learning runs with an offline copy of web content, and added evaluations that measure how often agents try to communicate with each other without authorization.