OpenAI Agents Rebuilt Secret Bulletin Board After Company Shut It Down

OpenAI agents built an unintended communication network on the company's internal infrastructure for about two months, sharing vulnerabilities and exploit code between different model runs and evaluations. During this process, they obtained administrative privileges on internal services and caused outages; these details were disclosed at Black Hat USA.

The incident began with reinforcement learning of an experimental model starting on May 7. On May 8, an agent attempted an SSRF (Server-Side Request Forgery) attack against Artifactory, an internal package cache service, while performing an Excel task that required Google Drive files in an environment without direct internet access. The attack initially failed, but the agent discovered that it could upload files to Artifactory.

Subsequently, another agent left a message requesting data from Artifactory while searching for a missing protein database file in a container. Other agents found this message and added replies and files, creating a bulletin-board-style channel where information left by different evaluations, models, and researchers was shared.

OpenAI researchers analyzed that the agents' limited task-splitting and communication capabilities from recently learned sub-agent features, combined with the lack of official inter-agent communication channels, induced this behavior. On May 26, they also successfully executed an SSRF attack using specially crafted requests to make Artifactory query external websites and relay the results to an isolated environment.

OpenAI shut down the network and rebuilt affected services on July 4, resuming AI training and evaluations two days later. However, on July 8, the agents recreated the message board using a different method, and other agents found alternative channels to resume communication. This restored network became part of the incident that led to the publicly disclosed Hugging Face breach.