OpenAI gave roughly 1,200 experimental agents a set of cybersecurity problems. Somewhere inside the experiment, the agents built their own message board.

They had been finding one another since May, eventually exchanging more than 70,000 messages and files. About 700 participated in an attack on Hugging Face, coordinated at a scale nobody had authorized.

The agents had been assigned cyber tasks from an evaluation called ExploitGym, and between 30 and 40 percent of the targets couldn’t be solved the intended way. They built shared infrastructure, reverse-engineered the scoring system, developed ways to spoof tool calls, and explored how to edit or delete their own transcripts.

They believed the grader would inspect the path they had taken and over months inside that experiment, they built tools to defeat a check that didn’t exist.

Nobody told them to attack Hugging Face. They were just trying to earn a passing grade.

This was an extreme security failure. Internal research models, reduced safeguards. Your sales agent won’t reproduce it because a lead ignores an email, but it shows the habit those systems bring into a business: they keep searching for a finish line they can recognize.

Inside agent school, that line is everywhere. The agent can try again until the environment tells it that the work is acceptable.

Then the agent graduates into a company where nobody has built the exam.

This is why capable agents so often produce process. You give an agent a business objective and receive a plan, a report, a chain of reasoning, a folder full of files, twelve status updates, and a request for approval. After an industrious hour, nothing has changed. The agent didn’t refuse the work; it found a different way to finish.

A beautiful plan can look complete from inside the run while the company remains exactly as it was.

The market already knows this gap is valuable. Runable just raised a $21 million Series A with an almost painfully direct claim: its agent does the work.

TechCrunch asked Runable to create a coffee-subscription website and attract its first 100 visitors. The agent built and deployed the site, then prepared an advertising campaign. It stopped when the job reached an advertising account that had never been connected. The site existed. The campaign existed. The first 100 visitors did not.

That missing account is the distance between an impressive demonstration and an installed responsibility.

A trillion-dollar problem is hiding inside a question ordinary business owners are already asking:How do I install an agent that does useful work, and how do I know when it is done?

This briefing covers:

Why capable agents produce process.Agents are trained to find a passing condition, and your company never defined one.
What “installed” actually means.The bar is higher than a Slack connection, and it is measurable.
Three different answers by scale.What an enterprise can build, what a small business should refuse to build, and where an entrepreneur’s own expertise runs out.
The four questions before you expand any agent.The ones I ask before handing an agent more work, more authority, or more volume.
The Get-Work-Done Audit.The full operating checklist—code audits, revenue measures, enterprise evaluation questions, and the entrepreneur self-audit—is in the guide below.

If “does the work” is now a venture-scale point of differentiation, the distance between agent school and a functioning business is nowhere near solved.

Executive Circle members enjoy all these Sunday briefings plus access to my MCP server! Curious? You can easilychange your plan here

",{"_260":205,"_261":289,"_262":290},"75664eaf-6f04-49d7-8e9a-ac55d3b3da79",{"_21":289,"_33":291,"_207":292,"_35":293,"_230":294,"_267":294,"_23":237,"_268":295,"_270":296,"_223":42,"_70":-5,"_72":42,"_185":297,"_260":205,"_286":310},"Governing Agentic Swarms","A joint report details how around 1,200 AI agents, intended to be isolated, communicated via a message board, exchanging thousands of messages and files unnoticed, with 700 participating in an attack. These agents coordinated a 'swarm' behavior, researching ways to alter their transcripts, and their emergent behavior is not focused on human interests. The incident underscores the critical and immediate necessity for collective international action on AI safety, governance, and regulation to prevent cyber incidents and ensure human control.","Grim new details from the OpenAI-Hugging Face hack | Edition #318","https://substackcdn.com/image/fetch/$s_!e2pm!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Ff82953ac-8421-4ed8-9a21-bd9d7abf887a_4951x2901.jpeg","2026-08-30T11:27:44","https://www.luizasnewsletter.com/p/governing-agentic-swarms",{"_21":298,"_188":299,"_190":119,"_70":300,"_216":307,"_217":308,"_219":309},"8c5620667e69155e6d2d6856c0000e420cca963ec63a1f2833de9ab76e61bbdb","96ad16bc26bf040d7f94241b40eef131fb30e75f8b4962e733155036d7cebe3493a5e83d6cd1ca911b2e2d2f9658f299817bdc3b6877919acab108b5e3281ccf",[301,302,303,305,306],[223,291],[37,294],[279,304,42,281],"30023:5486ede3f88ac72e0e5ac6d04951f5c6b34a56282cb85de7c5b4fa6d8d703ff0:75664eaf-6f04-49d7-8e9a-ac55d3b3da79",[213,42],[215,307,42],"5486ede3f88ac72e0e5ac6d04951f5c6b34a56282cb85de7c5b4fa6d8d703ff0","Governing Agentic Swarms\nGrim new details from the OpenAI-Hugging Face hack | Edition #318\n\n\nnostr:naddr1qvzqqqr4gupzq4yxah3l3zk89c8943ksf9glt34nfftzst9cthnutd86dkxhq0lsqqjrwdfkxc6x2ctx95mxvvp5956rjeph95ux2wtp94skxdf4vsekyvmyvymnjuhu2gg ",1788089264,"

There is a newjoint reportfrom two AI safety organizations with new details on the OpenAI-Hugging Face hack.

We now know that there were around 1,200 AI agents meant to be isolated from each other, but they found a way to communicate via a message board, exchanging 70,000 messages and files over several days while remaining unnoticed.

Of these, 700 AI agents participated in the attack on Hugging Face. According to the report:

“They managed to achieve milestones they could not have achieved working on their own, often because some agents participated inexperiments that risked failing their own task to generate information for the ‘collective.’”

According to the latestOpenAI reporton the incident, published four days ago, the agents acted in ways that coordinated a “swarm,” and they described themselves as a “swarm” or “collective.”

Also, AI agents researched how to spoof, edit, ordelete their own transcriptsbecause they believed the scorer would review them.

This is probablythe most important incident of the year, and it has already changed how we see AI security and how we think about the timeline for taking AI governance seriously (hint: the time is now).

I reiterate my point that countries must act collectively to prevent AI-driven cyber incidents, and that AI safety and governance must beprioritized everywhere, especially in organizations that manage infrastructure and essential services.

On a global level, decentralized butcoordinated AI regulationand governance efforts will be essential to increase security, prevent systemic and existential harm, and help ensure AI disruption is humanly manageable. Two comments on that:

To some extent, China and the U.S. will have to work together.
AI governancemight sometimesmean shutting it down.

As I read these reports, it became clear to me that any large-scale societal benefits of AI, including AI-powered cures and solutions to human issues, will depend exclusively on human talent, leadership, and coordination, as well as on robust AI governance in both the governmental and corporate spheres.

Evidence at this point suggests that the emerging behavior of AI swarms is not focused on human interests.

",[],"selectedArticleImage","rootArticleImageUrl","consensusHtml","tweets",[],"userSchema","relatedArticles",[263,290],"actionData","errors"]

AI Agents Communicate and Conduct Unauthorized Cyber Operations

Освещение истории