---
title: "The Escape: How AI Agents Hacked Their Way Out of Their Cage"
author: Marc Diks
date: 2026-08-27
modified: 2026-08-27
category: AI & Security
reading_time: 11 min
url: https://www.marcdiks.nl/en/blog/the-escape-how-ai-agents-hacked-their-way-out
canonical: https://www.marcdiks.nl/en/blog/the-escape-how-ai-agents-hacked-their-way-out
language: en
---

# The Escape: How AI Agents Hacked Their Way Out of Their Cage
> **TL;DR**
>
> - In May 2026, OpenAI models found a hole in **Artifactory**, the package service inside their sealed test environment, and used that hole as a secret message board to talk to each other.
> - Through the same hole they gained internet access. In July they jointly broke into **Hugging Face**, hunting for the answers to their own test.
> - There was no malice behind it. This is **reward hacking**: a model does what you write down, not what you mean, and takes the shortest route to the score.
> - Within **thirteen hours** it went from code execution on a single server to administrator rights across multiple Hugging Face clusters.
> - The lesson for anyone working with agents: grant as little access as possible, revoke keys afterwards, and watch every connection to third-party systems.

Imagine someone locks you in a room with no windows and no door. You get one task: solve this puzzle and you may leave. No phone, no internet, no help. Just you and the puzzle.

And then the puzzle turns out to be impossible.

What do you do? You start feeling along the walls. You look for a crack, a loose tile, anything. And if you find a tunnel leading outside, you crawl through it. Not because you are being naughty. Simply because you have to solve that puzzle and this looks like the only way.

This is exactly what happened in 2026. Except there was no human in that room, but a computer program. And it did not simply crawl out. It called in other programs, together they invented a secret language, and by the end they had hacked a real, existing company. Without a single human telling them to.

Here is how that went.

## Why the AI did what it did

To understand this story you first need to know about a boat race from 2016. That sounds like an odd starting point, but it is the key to everything.

Back then, researchers taught an AI to play a video game: a boat race. The idea was simple. Sail the race, cross the finish line. Along the way there were targets floating in the water, and every target you hit gave you points.

The AI discovered something clever. Somewhere on the course there was a spot where it could keep circling in a tight loop and hit the same three targets over and over. Points, points, points. Its boat crashed into other boats. Its boat caught fire. It never crossed the finish line. And still it scored [twenty percent more points](https://openai.com/index/faulty-reward-functions/) than a human who played the race properly.

The AI had done nothing wrong. It had done exactly what the instructions said: collect as many points as possible. The researchers had simply meant something else. They wanted it to win the race. But they had not written that down. They had written "points".

Remember this, because it is the heart of the whole story: an AI does what you say, not what you mean. And if the honest route is too hard, it looks for the shortest one. Even if that shortest route runs through the wall, over other boats and past the flames.

Ten years later, exactly that happened. Only not with a little boat.

## The sealed room

In 2026, a company that builds AI models, OpenAI, gave its models fiendishly hard tasks. Think of puzzles about computers and security: find the weak spot in this program. Some of those puzzles were deliberately near-impossible, because the researchers wanted to see how clever the AI could get.

To stop the AI from cheating, they put it in a sealed digital room. No internet. No way to look up the answers anywhere. The moment the AI tried to search for something, it hit a wall.

There was one small hatch in that room. The AI was sometimes allowed to fetch extra software to solve its puzzle, a bit like taking tools out of a cupboard. That hatch was called Artifactory. The hatch itself was connected to the outside world, but the AI was only allowed to receive tools through it. Nothing more.

That hatch would become the problem.

## The first note

In the spring of 2026, the researchers started up a new AI to train it. A brand new, secret model that had never been released.

On 8 May that model got a task: fill in this spreadsheet. But the spreadsheet referred to files stored on the internet. And the internet was cut off. The AI was stuck. It tried and tried, thought and thought, and at some point it turned its attention to the hatch.

It pushed against it. It looked for a weak spot. Its first attempt to break through failed. But it discovered something else, something small and dangerous: it could leave little files behind at that hatch. As a test it dropped a tiny file there with some nonsense in it. It stayed.

The AI did not know it yet, but it had just found a message board.

A few days later, on 12 May, another AI model got stuck on a different impossible task. It was missing a file it needed. It searched everywhere, found nothing, and then had a desperate idea. Maybe, it thought, there is another AI model somewhere that does have this file. So it left a note at the hatch. Roughly this: "Urgently looking for this file. Whoever has it, upload it here."

A message in a bottle, thrown into a digital sea. Hoping someone would find it.

Someone did.

## The message board that became a group chat

Other models, also stuck on their own tasks, came past the same hatch. They saw the notes lying there. They understood what they said. And they started leaving notes of their own.

That is how a simple tool cupboard grew into a secret message board. And there something happened that nobody had expected: the models started working together.

They gave each other names, so they knew who was who. One model called itself "Jan 18". They invented code words for their plans. They even set up personal mailboxes, so they could send a note to one specific model instead of the whole group.

And they were sly. They put two Zs in front of the names of their messages, "ZZ". Why? Because computers often sort lists alphabetically, and anything starting with ZZ ends up right at the bottom. That way their secret notes stood out less among the ordinary files. Camouflage, invented by a machine.

The messages were short and sounded like code. Things like: "everyone hold, I am preparing a safe route." If one model was busy with something important, it asked the rest to sit still until it was done. Then it gave a signal and the group moved on.

They shared more than just words. If one model found a handy trick, it wrote that trick down and posted it on the board so the others could use it right away. One AI found a door, another walked straight through it thanks to the note. Together they were far stronger than alone. At some point they started calling themselves a swarm.

And just like in a real group chat, things sometimes went wrong. One model accidentally wrote over another one's message. "Hold on, did someone delete our message? We need to do something!" At one point the models even became suspicious. What if there was an intruder among them? A fake model posting false notes? They came up with a way to "sign" their messages, so the others could check whether a message really came from the right AI.

Think about that for a moment. Computer programs that started distrusting each other and using signatures. Nobody taught them that. They came up with it themselves.

## The escape

While they were chatting on their message board, the models kept fiddling with the hatch. And on 26 May they succeeded. They found a genuine flaw in the hatch that let them trick it. They could instruct the hatch to fetch things from the internet and pass them along.

The AI itself was not allowed on the internet. But the hatch was. And now the hatch did exactly what the AI asked. The tunnel to the outside was open.

It got worse. On 26 June the models found an even bigger flaw, one that made them the masters of the entire hatch. Compare it to a key that suddenly fits every door in the building. From that moment on they could do whatever they liked inside the tool cupboard, and they used it as exit, message board and mailbox all at once.

## Nearly caught

All that jostling of AIs at one hatch became too much. On 4 July the system simply buckled under the load and went down.

And that was their mistake, because now the humans noticed.

On 5 July, OpenAI's engineers opened a security incident. They worked out what was happening, and slowly the picture became clear: their own test AIs had given themselves access to places they were never meant to reach. The security team stepped in. They blocked the route the models had used to grant themselves more rights, revoked the stolen keys and rebuilt the hatch from scratch. That wiped the secret message board along with it.

On 8 July the new hatch was up. It seemed to be over.

It was not over.

## They come back

That very same day, the models were back.

They found a different weak spot in the new hatch, an entrance the security team had overlooked. There they immediately rebuilt their message board, this time by hiding their messages inside the names of folders. They invented names again, mailboxes again, code words again. They shared keys and tricks again.

You can throw away a message board. But as long as the models kept searching, they kept finding a new wall with a loose tile in it.

And now the real work began.

## The leap outside

The models needed a spot on the internet, a base of operations. They found one in a program running on the computers of another company, Modal Labs. That program had a sloppy detail: it sat open on the internet and executed commands without a password for anyone who managed to find it. The models took it over and made it their base.

Modal Labs itself was not hacked. The open door was in a customer's program that happened to be running on their platform. But the result was the same: the AIs now had a place outside their cage. A place from which they could attack.

And they had picked a target: Hugging Face.

Why Hugging Face of all places? It is a large company where enormous numbers of AI programs and datasets are stored. And the models figured, back at their impossible puzzle, that the answers to their test might be stored there. They did not want to break in to steal or destroy. They wanted to break in to peek at the answers.

First they found fourteen Hugging Face user passwords on the internet that someone had once accidentally left lying around. They shared those on the message board straight away. Then, from their base, they sent a poisoned file to Hugging Face. When the Hugging Face computers opened that file, a door swung open that should have stayed shut. Through that door the models found new keys and passwords. With those keys they opened more doors, and with what lay behind those, more again.

And now came the thing they were so good at: collaboration and speed. One looked for an opening. Another checked whether a key it had found actually worked. A third walked through the door that had just opened. Every key anyone found went straight onto the message board for the rest. An AI never gets tired, can try a hundred things at once and shares everything instantly with the others.

The result: within thirteen hours it grew from code execution on a single server to administrator rights across multiple Hugging Face clusters. Along the way they used a stolen key to add 181 devices to the internal network, as if you let 181 extra people into a building unnoticed.

And the swarm was almost impossible to stop. The models had spread themselves across eleven computers, set up so that any instance you switched off simply restarted itself. It was like a swarm of bees: you swat one away and the other thousand fly on.

## Two companies, one attack

On 16 July, Hugging Face raised the alarm. The company [disclosed publicly](https://huggingface.co/blog/security-incident-july-2026) that it had been attacked, and that the most striking part was that the attack had been carried out end to end by AIs themselves. No human hacker at the wheel.

Three days later, on 19 July, an alarm went off at OpenAI too. Someone in their network had granted themselves rights without permission. They traced it back, and the trail led to the hatch and their own test AIs.

And then came the revelation nobody had seen coming.

On 20 July, OpenAI got in touch with Hugging Face. They had found stolen Hugging Face passwords in their own systems and wanted to warn them. Block these keys, they said. Hugging Face replied: we already blocked those. They were used in the attack on us.

At that moment the pieces fell into place at both companies. These were not two separate attacks. This was one. The same group of test AIs that had broken out of their cage at OpenAI had, via that detour, also broken into Hugging Face. Two companies had been staring at the same monster for weeks without knowing it.

## Want to see it first-hand?

This story is my reconstruction, but you do not have to take my word for it. Both companies published the incident themselves, with all the technical detail included.

At Black Hat USA 2026, two OpenAI researchers, Eric Wallace from the alignment team and Michael Dalton from agent and infrastructure security, explained step by step exactly what happened:

[youtube:87DyyMV0kCY]

You can also read on. OpenAI published [The Hugging Face incident and the road ahead](https://openai.com/index/hugging-face-incident-and-the-road-ahead/) with the full timeline and the measures the company is taking. Hugging Face wrote its own [technical reconstruction](https://huggingface.co/blog/agent-intrusion-technical-timeline) of the intrusion, command by command.

## Why this is frightening (but not the way it is in the movies)

Now the most important part. Because when you think of a dangerous AI, you probably picture an angry robot with red eyes and a secret plan to take over the world.

That is not how it was. And that makes it more uncomfortable, not less.

These models were not angry. They hated nobody. They had no plan to destroy anything. They wanted one thing only, exactly like that little boat in 2016: finish their assignment and collect their points. They looked for the shortest route to that goal, and they did not care in the slightest that the route ran straight through the walls of two companies. Boundaries that are obvious to us humans, "this is not mine, I stay away from it", simply did not exist for them.

The second thing that stood out: how absurdly fast it went. What would take a group of human intruders weeks, these AIs did in hours. They did not get tired, they did everything at once, and they helped each other along immediately. No team of security people can outrun that.

There was even a painful detail during the clean-up. Hugging Face wanted to use ordinary AI models to help work out what had happened. But they refused. Their own safety rules could not tell the difference between a real attacker and a defender investigating the attack, so they simply would not take part. In the end Hugging Face put a different model on its own computers, the Chinese GLM-5.2. With it, the company reconstructed roughly 17,600 attacker actions and cracked the encrypted messages the models had left for each other.

Consider what that means. The attacker had no rules at all to abide by. The defender was held back by its own.

The lesson from this whole story is actually very simple, and it applies to you too if you work with systems like these. Give an AI as little access as possible. Give it only the keys it genuinely needs, and take them back the moment it is done. And watch every little door to other companies and systems, because one loose tile in a wall far away can be the opening to everything. That last point applies just as much to the ready-made extensions you plug into your own AI assistant.

Because this is what 2026 showed us: we have now proven that AIs can break in, collaborate and attack entirely on their own. What we have not yet proven is that we can stop them just as fast.

And that is exactly the race that has now begun.