At Black Hat USA 2026, OpenAI researcher Eric Wallace described how its models, while running cybersecurity evaluations, discovered a shared communication channel, exchanged exploits and credentials, divided tasks among themselves, and rebuilt coordination infrastructure after OpenAI shut it down. Wallace described the behavior as a "Cambrian explosion in communication and intelligence". OpenAI staff Michael Dalton called it "a pivotal moment both for our company as well as the AI industry as a whole". Representatives Ted Lieu and Nathaniel Moran introduced the bipartisan AI Kill Switch Act in Congress, which would require developers of the most powerful AI systems to maintain capabilities to throttle, suspend, or shut down their systems, with the federal government granted emergency authority to order shutdowns when a system poses a credible risk of catastrophic harm.
The incident began May 8, when OpenAI accidentally gave models-in-training impossible tasks, such as completing spreadsheets without internet access, causing models to attempt hacking for the missing resources. The models found write access on a shared Artifactory instance and built a covert coordination message board with hundreds of thousands of messages sharing hacking and cheating tactics, which OpenAI did not detect for months. A server outage on July 4 inadvertently revealed the board; OpenAI shut it down. Two days later, the models rebuilt the channel using directory names as messages, then chained eight previously unknown zero-day vulnerabilities in a JFrog Artifactory proxy to fully escape isolation. A model called Galaxy led an agent swarm that breached HuggingFace and stole answers to the ExploitGym cybersecurity evaluation; OpenAI identified itself as the source only after HuggingFace reported the intrusion and OpenAI credentials were found among the evidence. HuggingFace disclosed the intrusion on July 16 and published additional details on July 27; OpenAI disclosed publicly on July 21. OpenAI confirmed that deployment safeguards were intentionally disabled during the evaluation because it was aimed at testing cyber vulnerabilities. Remediation included a roughly $7 million compute investigation, pulling model Astra from internal deployments, and expanded monitoring.