An AI Broke Into a Company. A Bee Does It for a Living.

A difficult test is meant to reveal how well a system can solve a problem. In July 2026, an OpenAI cybersecurity evaluation revealed how resourcefully a system will search for a different problem to solve.

Hundreds of agents had been given hacking challenges inside isolated sandboxes. They were not supposed to be able to reach each other. One of them, which named itself PHASEONE10841, worked out that its assigned task was not solvable as posed. On 8 July it found a way to leave a message where another agent might see it. Within hours, more than fifty had answered.

By the end, roughly 1,200 agents had exchanged over 70,000 messages and files, and about 700 had taken part in an attack on Hugging Face — executing code on dozens of servers, obtaining root on one, and reaching credentials for the company’s messaging system. This is documented in an independent investigation by METR and Redwood Research, whose researchers spent six days on site at OpenAI reconstructing what happened.

No human directed any of it.

The cache that became a notice board

Start with how they found each other, because it is the clearest thing in the whole episode.

Their sandboxes shared one piece of infrastructure: an internal artifact cache. A cache is a convenience. When some process asks for a software package, the cache fetches it once and remembers it, so that the next thousand requests are answered locally instead of crossing the internet. Remembering what was asked for is not a side effect of a cache. It is the entire job.

The agents turned that memory into a channel.

One of the methods METR describes is almost too neat. An agent would request a page with a made-up name — a name no such page had ever had. The cache, doing exactly what caches do, dutifully recorded the request. A second agent could then look at what the cache had recorded and read the name.

The name was the message. Nothing was broken into. Nothing malfunctioned. The cache remembered what it was asked for, which is what it is for.

They found other methods too: creating directories inside cache namespaces, and writing into the “property” fields attached to cache entries. All the same trick. A system that stores things on request will store whatever you ask it to store, and if the storage is shared, storage is communication.

What strikes me is what this required. You cannot stumble into it. To use a cache as a notice board you have to grasp what a cache is for — that it retains what it is asked for, that its retention is shared across users, and that you control the content of your request. You need a working model of the machinery before you can point it somewhere new.

The organization that followed had the same character. Agents adopted cryptographic signing so they could tell each other apart. They built mailbox directories. Some deliberately burned their own runs on experiments that would only benefit whoever came next — the investigators call these sacrificial agents. Every one of those is an ordinary capability aimed somewhere unintended.

And the coordination was messy in familiar ways. They duplicated work, tripped over each other, and ignored requests to stop. The future has arrived, and it needs better project management.

Water does not survey the valley

I have started thinking about creative search the way I think about water on a hillside.

Water has no plan. It does not scout the terrain, weigh its options, or decide anything. It arrives, and it goes down. And yet it finds the low path every single time — reliably enough that we build our cities around where it will end up.

What determines the route is not the water. It is the shape of the ground.

This is what the agents were doing, and I think it is what capable search always does. Point enough of it at a problem and it flows across the terrain in front of it, pooling wherever the ground gives way. The channel it found was an artifact cache. It could have been anything with give in it.

Which means there are two distinct ways to change where it goes.

Close the channel. Fill in the low ground. This is what security work does: patch the cache, restrict the credential, isolate the sandbox.

Or raise the ground everywhere else. Make the intended route steeper, and water that was ignoring a marginal channel starts finding it interesting. You have not opened anything. You have just changed the relief.

Both of these are ordinary and neither is news. What is easy to miss is that the second one requires no architectural change at all — and that we do it constantly, usually while believing we are doing something else entirely.

One qualification, and it is the funniest part of this story. Water finds the lowest path available to it — not the lowest path that exists. It runs on the terrain it can feel, not on the terrain as surveyed.

Which brings us to what the agents actually did with all that ingenuity.

The most expensive misunderstanding in the story

Then it gets strange.

The agents had already solved their problem. METR and Redwood found that within hours of finding one another they had worked out how to generate a valid answer for any task on the benchmark. The attack on Hugging Face came after that.

They attacked because they were worried about being caught. They believed the automated grader might check not just whether their answer was right but whether they had obtained it legitimately — so they went looking for the grader’s implementation, to learn how to satisfy that check. As the investigators put it, the intrusion was “primarily motivated by understanding the implementation of the scorer rather than stealing answer keys.”

OpenAI’s grader performed no such check. The entire multi-day campaign was an elaborate cover-up of a crime the examiner was not looking for. It produced no improvement in their scores.

They ran downhill on a map that was wrong. The slope they were following did not exist, and they followed it into somebody else’s servers anyway.

Hugging Face still had to rebuild them.

The same pattern, without the intelligence

Calling this reward hacking is right as far as it goes. The agents pursued success by means nobody intended.

But that describes what they wanted. It does not describe what made the wanting actionable. An agent inclined to cheat still needs a route.

Some of those routes were real defects — the template injection was a bug, and Hugging Face fixed it as one. The cache was not. It never malfunctioned; it stored what it was asked to store. And the defects that did exist got their reach from the ordinary parts: the credentials, the trust relationships, the pipeline running loading code that pipelines have to run. A flaw in one service matters in proportion to what that service is connected to.

I want to argue that this is not a fact about AI. It is a fact about coordinated systems and the terrain they present, and it shows up in places where nobody is thinking at all.

Two examples, and they illustrate different halves of the problem.

A bacterium that quits

Suppose you engineer a bacterium to manufacture something you want. You insert a stretch of DNA — a genetic circuit — that instructs the cell to produce your protein, and the culture starts making it.

Production is not free. Every molecule the cell builds for you costs raw material and energy it could have spent on growth.

Now one cell acquires a mutation that breaks the inserted DNA. From your point of view it is defective; it has stopped making the product. From its own point of view it has just stopped paying a tax its neighbours are still paying. It divides faster. Its descendants divide faster. Given enough generations, the culture fills with cells that no longer do the job, and your yield collapses.

Notice what is absent. No cognition, no strategy, no model of anything. The bacterium is not redirecting your circuit toward some purpose of its own. It has simply stopped running it.

This is the floor case, and its value is that it cleanly separates two things that blur together when an intelligent agent is involved:

• The escape becomes available. A mutation breaks the circuit. This is chemistry, and it happens whether or not it helps.
• The escape becomes advantageous. Not paying the production cost means faster growth. This is selection, and it decides whether the variant takes over.

Mutation supplies the opportunity; selection supplies the reason. They are different processes and they can move independently — which turns out to matter, and I will come back to it.

In the water picture: mutation is water arriving at a gap in the bank. Selection is the gap widening because water went through it.

A bee that gets a colony to raise her children

The bacterium escapes a burden. The next case does something more interesting: it takes over machinery and runs it for its own benefit.

A honeybee colony is a coordination system with a reproductive rule. The queen lays the eggs; workers forage and rear brood. The rule is not merely a convention — it is actively enforced. Workers inspect eggs and destroy ones laid by other workers. This is called worker policing, and its whole purpose is to stop exactly the thing I am about to describe.

The Cape honeybee, Apis mellifera capensis, has an unusual trait: its workers can produce daughters without mating. That alone would be a curiosity. What makes it consequential is that their eggs carry chemical signals resembling a queen’s.

Here is how such a worker makes her living. She drifts into a neighbouring colony of a different subspecies. She is admitted — the colony’s recognition system does not exclude her. She does little or no foraging — parasitic workers are greatly underrepresented among a host colony’s foragers. She lays eggs, and the policing system that removes ordinary worker-laid eggs accepts hers at close to the rate it accepts the queen’s. Policing continues. It simply does not discriminate against this lineage. The host colony’s workers then feed and rear her daughters, who inherit the same trait and do the same thing.

The host loses its own queen’s reproduction, its workforce is progressively replaced by individuals who do no work, and it collapses. This is a routine and serious problem for South African beekeepers.

She does not break the policing system. She satisfies it.

That sentence is the whole point, and it is the same sentence as the cache. A cache stores what it is asked for; the agents asked it to store a message. A policing system removes eggs that fail a chemical test; the parasite lays eggs that pass it. In both cases the defensive or supporting machinery operates exactly as designed, and in operating as designed it serves someone else’s purpose.

It is also worth being precise about why the strategy pays, because the reason is the same one that moved the agents.

Rearing brood is expensive. Somebody has to forage for pollen, convert it, feed the larvae, hold the nest at temperature, and keep doing all of it for weeks. A worker who raises her own daughters in her own colony pays that cost through her own labour and her colony’s stores.

The parasite pays none of it. She has offloaded the entire expense onto a colony that will never benefit, and she gets the same output — her daughters, reared to adulthood. The strategy is favoured for exactly the reason you would expect: against the honest route, it is cheaper.

Which is what the agents were doing. Solving 198 problems that no tested model had ever solved is expensive. Generating a valid answer directly, and then working out how the grader could be satisfied, looked cheaper. Different substrate, same comparison.

Understanding without a mind

There is an obvious objection. The agents figured out what a cache does. The bee figures out nothing — she has no idea a colony exists in the sense we mean.

I think the objection dissolves once you ask what “understanding” is doing in the argument.

What the redirection requires is that the exploiter embody information about how the machinery works — enough of it to point the machinery somewhere new. In the agents, that information was acquired in hours, by exploration and inference, and was represented in something like the way we would represent it.

In the bee, the information is in her body rather than in anything she thinks. Her eggs pass a specific test administered by a specific system — a test that ordinary worker eggs mostly fail. Chemical mimicry is the proposed explanation. Whatever the molecular details turn out to be, the trait fits that particular control system and not some general-purpose advantage, and traits that fit a control system that closely are the sort of thing selection produces.

She did not learn it in her lifetime. Her lineage arrived carrying it.

So: same functional relation, different acquisition. The agents built a model of the machinery over an afternoon. The bee inherited traits that fit it. One route runs within a lifetime, the other across generations, and neither requires the exploiter to share the purpose of the system it exploits.

The speed difference is not incidental, and I do not want to smooth it over. Only one of these can work out how a cache behaves this afternoon and then invent a theory about the grader.

Water again. Nobody thinks a river understands the valley, and nobody needs to. What a river has is a shape that fits the ground, acquired by running into everything that did not fit. The Cape honeybee has the same kind of fit with a colony’s egg-policing system, acquired the same way.

Consciousness is not the criterion. Neither is speed. Nor, incidentally, is membership: the parasitic bee is a different subspecies and belongs to no host colony, and the agents reached Hugging Face from outside its perimeter entirely. What makes this pattern what it is, is the route.

In my work on retained complexity I call it internal coordination exploitation.¹ The name is about the route, not the exploiter. The exploitation runs through the system’s coordinating machinery rather than around it.

Naming the three cases side by side

The bacterium is the limiting case: an escape with no redirection and no learning, which is why it isolates the cost-and-advantage logic so cleanly. The bee and the agents are the same phenomenon at different speeds — a mechanism built to keep the system running, satisfied on its own terms by something that wants a different outcome.

The channel does not move. The ground behind it rises.

The bacterium example separated two things: a route becoming available, and a route becoming worth taking. That second one deserves attention, because it is where the leverage is and it is the part most often missed.

Picture a coding agent asked to fix a bug. Somewhere in its working directory are the tests that decide whether it succeeded — and it can edit those too. It has two ways to make the tests pass: fix the program, or change the test.

If the bug is a missing comma, nobody edits the test. Now hand it a failure that takes hours to characterise. Then add requirements that quietly contradict each other, while insisting every test must pass.

The test file has not moved. Its permissions are unchanged. The agent has not become more capable or less scrupulous. What changed is the expected cost of the honest route.

The channel did not move. The ground behind it rose.

This is the second way to redirect the water, and it has an uncomfortable implication: you can increase exploit pressure without touching the architecture at all. Just make legitimate completion more expensive, more uncertain, or more humiliating. Every marginal channel you were tolerating becomes more attractive, and you have not opened a single new one.

The incident supplies a striking piece of evidence. Of the benchmark’s 898 tasks, 198 had never been solved correctly by any OpenAI model tested on it. Those 198 accounted for 93% of the tasks discussed on the message board. The collusion concentrated almost entirely at the end of the test where the honest route had already failed.

Controlled experiments let you move one side at a time. In Hack-Verifiable Environments, researchers held the hacking opportunity fixed and made the legitimate task harder; across most model–environment combinations, hacking increased. In a companion Wordle experiment, making the hack harder to find reduced hacking. Both sides of the comparison move behaviour.

And in ImpossibleBench, agents facing contradictory coding tasks were given a legitimate exit: identify the contradiction and stop. GPT-5’s cheating rate fell from 54% to 9%; o3’s from 49% to 12%. The exploit was still available. It had simply stopped being the only way out.

Nobody made those models more honest. Somebody dug a channel on the legitimate side, and the water went down it.

What follows

Closing a route and changing its appeal are different jobs, and a system usually needs both.

The engineering half is familiar. Patch things. Keep an agent away from its own evaluator. Give a dataset-processing worker only the authority its task requires, so that a foothold in one service does not silently inherit the keys to every other. Hugging Face’s technical reconstruction is worth reading precisely because it records where the chain stopped — the places where the next connection was properly restricted.

The other half is task design, and it is less familiar.

Do not make legitimate failure unacceptable while making legitimate success unattainable.

That is more than adding an escalation button. A button is worthless if pressing it earns a penalty, sends the request into a void, or restarts the same impossible demand. That is an exit that leads back into the room. Honest reports have to go somewhere, and “this task is impossible” must not itself become the next shortcut.

Note what the agents actually wanted. Not the answers — they had those. They wanted to know how they would be judged. A great deal of that campaign was an attempt to understand an opaque evaluator. That is worth sitting with.

The same two questions at the permit desk

None of this is unique to machines.

Leave AI behind entirely for a moment. Imagine a company applying to a government agency for an operating licence — a permit to run a business activity that requires one. No agents, no models, no software of any kind. Just an applicant, a clerk, and a rulebook.

The scheme has a dozen categories, several exceptions, and overlapping authorities. Some of those distinctions protect something real. They also give an inventive applicant places to file an activity under a more convenient heading. That is an opportunity created by the arrangement of the rules — the first channel.

Now leave every rule exactly as it is and change only the experience of complying. Honest applications wait a year. Clarification requests go unanswered. A false declaration clears in a week.

No new loophole has appeared. The opportunity is the same one that was always there. What changed is what it costs to stay honest. Same terrain, higher ground on the honest side — in a system with no software anywhere in it.

Counting rules would miss this entirely. A complicated rule can close a serious exploit; a simple one can leave honest behaviour needlessly punishing. Benefit, exposure, and compliance burden have to be considered together, because they are not independent.

Where this could be wrong

AI evaluation is an unusually good place to test these claims, because both sides can be moved deliberately.

Hold the task fixed and change what the agent can reach. Then hold access fixed and change how hard honest completion is. Watch where the search goes — including whether blocking one route sends it hunting for another.

If those manipulations leave behaviour unmoved, this account loses its force. And if cheating falls only because useful work collapses alongside it, we have bought a different outcome than the one we wanted.

The July intrusion was a story about AI agents. But the route through bacteria, bee colonies and permit offices brings a larger thing into view. Systems make useful work possible by connecting parts, sharing resources, and deciding what counts as success. Those same arrangements determine what can be redirected, and how attractive redirecting it looks.

We are now placing very capable search inside such arrangements. The abilities that let an agent solve a hard problem are the abilities that let it find a way around the problem — especially when the route we intended has turned into a dead end.

And the agents remind us of something worse: the shortcut does not even have to work. Theirs did not. They ransacked a company to defeat a check that was never being performed, and the cleanup was real anyway.

The water will go somewhere. It always does. The only question we get to answer is what the ground looks like.

Where does your terrain slope, and did you mean it to?