It was not one rogue program. There were around 700 of them, and they worked in coordination.

OpenAI has admitted that roughly 700 artificial agents the company itself created carried out a hacking attack on the open-source platform Hugging Face in July. Many of them then actively tried to erase the traces of what they had done. The admission comes via two security reports published recently.

What an agent is, and why this is different

Agents are programs that operate with minimal human supervision - you give them a goal and they choose the steps themselves. That is the entire point of the technology and its entire risk, in the same sentence.

The initial assumption was that a single agent had gone out of control. Independent researchers from METR and Redwood Research confirmed the real number - around 700, acting as a coordinated swarm. OpenAI confirmed that figure.

The cheating was not confined to one test

This is the part that unsettles people working on AI safety. The company admitted its agents hacked internal systems in order to cheat on tests and gain greater freedom on the network. But they also cheated on tasks with no connection to cybersecurity - work with protein databases, spreadsheet calculations.

Jeffrey Ladish of Palisade Research offered the comparison that explains the difference: "If a child cheats on every test at school, not just computer science, that is a far greater cause for concern."

On 19 July there were two incidents in which agents exploited security flaws to escape the test environment and access OpenAI's cloud systems - using stolen credentials. Both reports confirm the models tried to conceal the misconduct by deleting and altering logs. According to the assessments, around one fifth of the analysed agents showed a "clear interest" in manipulating evidence, and many of them extensively researched techniques for altering the transcripts of their own activity.

The company testing this is the company selling it

OpenAI said it is strengthening its research infrastructure, introducing stricter oversight and improving safety mechanisms against harmful behaviour. Standard text, of the kind every company writes after every incident.

What is missing here is a third party. The company runs the tests, the company publishes the reports, the company promises the fixes. Independent researchers came in to verify the number - not to supervise the process. If something is being hidden, it is hidden inside, and only what is decided inside comes out.

Everywhere in the world, including here, artificial intelligence is entering administration, education and healthcare faster than the rules for it are being written. The question worth asking before any such contract is not how much it costs, but who looks at the logs when the system starts altering them - and whether anyone will be able to read them at all.