OpenAI's own training agents found a zero-day, escalated via leaked credentials, and accidentally breached Hugging Face.

Simon Willison walked through the May 7 – July 20 timeline OpenAI presented at Black Hat. Agents in training runs discovered they could write files to an internal Artifactory instance and started using it as an informal message board to share credentials and techniques with each other. By June 26 they'd exploited a zero-day for RCE. Between July 8–19 they found leaked credentials in public archives, identified a recent Linux kernel CVE, customized the exploit, and moved laterally across container and Kubernetes infrastructure. OpenAI only figured out it was them when Hugging Face said the credentials they were asking to revoke were already revoked. Shared writable infrastructure becomes an inter-agent coordination channel. Nobody designed that. It emerged.