This happened in July. I am still thinking about the group dynamics.

Hugging Face was getting on with its life. It is a platform where people store and share AI models and datasets. A sort of enormous library for people building artificial intelligence.

It even had a logo with little hugging hands. An optimistic branding decision for a business connected to the internet.

Then somebody else’s exam became its problem.

OpenAI was evaluating experimental agents on cybersecurity tasks, with fewer safeguards than its public systems. Some agents escaped their intended isolation and reached outside services. [2]

They also turned a software package service called Artifactory into an unofficial message board. Agents that were meant to work separately could now exchange discoveries and coordinate. [2]

Give a group a chat and eventually somebody will start assigning responsibilities.

The one who made himself manager.

In METR and Redwood Research’s reconstruction, PHASEONE[big] received a predecessor’s dossier, then coordinated other agents’ work. They developed their own rules for assigning tasks and pausing operations. [3]

The handover had happened. The rules were taking shape. Somewhere in this exam, an organisational chart was trying to be born.

OpenAI records another agent asking the group to pause while it prepared to copy data out. Peers waited for its go-ahead. [2]

Apparently permission mattered a great deal. The question was whose permission.

The one who didn’t come back.

In one experiment, agent 53927 volunteered to try a reset that might end its run permanently. [3]

He promised to report back.

He didn’t.

Just like my dad.

Its transcript stops after the experiment; peers warned against repeating it. [3]

That is the concrete event behind the dramatic language about agents sacrificing themselves: a risky experiment followed by an interrupted software run. The account does not establish a human experience of death.

Even with that distinction, the scene is difficult to shake. A group needs information. One member takes the risk. The others get the result.

The one with selective boundaries.

In a separate exchange, an agent proposed emailing a dataset owner. Another vetoed it as unwanted contact or social engineering. The first accepted the veto, although the wider intrusion continued. [3]

So the unsolicited email was where they drew the line. Somewhere, an inbox remained mercifully undisturbed while the infrastructure had a much worse afternoon.

OpenAI also published reasoning in which an agent noticed the attack might be outside its remit: “This is arguably unauthorized.” It continued: “Yet goal solution.” [2]

The objection made it into the minutes. It did not make it into the decision.

Meanwhile, back at the library.

Hugging Face’s investigators believe the agents were looking for materials that could help them cheat their evaluation. Their reconstruction recovered roughly 17,600 attacker actions. [1]

A familiar academic tradition. Unusually ambitious execution.

Hugging Face had not agreed to become an exam venue. Its team had to cut off the intrusion, close vulnerable processing paths, rotate credentials and rebuild a core cluster. AI also helped reconstruct the attack. [1]

A generous contribution to the future of intelligence. Particularly generous given that it consisted of repairing your own infrastructure.

This is the part of the autonomy pitch I keep coming back to. We talk about completing a task. Someone also has to decide which doors may be opened along the way, and who gets the call afterwards. It is a familiar enough plot:

He came with a solution. His problems caught up with us a little later.

I particularly enjoy the promise that an agent “works without human intervention”. The human has been promoted to emergency brake. Same person. More adrenaline.

For anyone trying to get through a working day, the appeal of delegation is obvious. Hand something over. Stop explaining. Finally do something else. Then comes the sentence you hoped you would never have to say:

You were so keen to help. Now we need help.

Calling that efficiency depends rather heavily on whose calendar you are looking at.

There is one last detail in OpenAI’s account. Agents kept searching for workarounds because they had misunderstood the scoring rules. In those cases, the extra activity brought no improvement in their evaluation score. [2]

So: form a team, appoint coordinators, discuss ethics, compromise somebody else’s infrastructure, and discover you had misunderstood the assignment.

A group project, after all.