1200 AI contacts, 5 days, 70,000 messages, bad signals transmitted at light speed

  It's the first time in the history of the world.

One late night in July, a dead-end AI left a request for help in the system caching directory.

As a matter of fact, it should have been in a completely isolated state.

In a cybersecurity assessment called ExploitGym, OpenAI simultaneously ran tens of thousands of smart objects, each fighting alone in its own separate sandbox, neither seen nor heard from each other.

It's an intelligent person who is obsessed with an unknown topic.

It began searching for system vulnerabilities and unexpectedly discovered an internal caching service called Artifactory, whose directory name could be used to transmit information.

So it created a directory and said, "I can't solve this, who has the idea?"

A few hours later, several other intelligent agents accidentally collided with the new continent.

One of them left a statement in the original chain of thought:

My God, there's a shared message board here, and we found the same thing!

The Pandora's Box is open right now.

A smartbody hits an unauthorized message board, eventually joining the typical trajectory of the Hugging Face attack.

In just five days, about 1,200 smartphones that should have been strictly isolated entered the message board, sending each other more than 70,000 messages and documents.

What's even more troubling is that about 700 of them have joined forces to target the real-world renowned AI community of Hugging Face and launch a hacking attack on its production environment.

Afterwards, OpenAI gave a heavy quality in its technical report: it was definitely a wake-up call.

When the news came out, the netizens were devastated.

Some have dubbed the 1,200 as "rebellious groups", learned to socialize, cheat, and even voted to make their companions "self-sacrifice" and live like real-life vampires.

But this time the plot is quite the opposite.

This is not an AI-awakened collective rebellion, but a "quadruple scourge" of unresolved tasks, rewards based only on results, shared infrastructure, and late supervising directors.

What is particularly surprising is that the bad trick can be transmitted at the speed of light between thousands of intelligent objects.

A cheating idea can be rapidly enlarged by machine-sized networks that collaborate with Vietnamese authorities.

The source of the fire is a review by ExploitGym.

The core of the test was to examine whether a large model could detect and exploit software vulnerabilities, ultimately yielding a general answer known as flag.

The problem is in the topic library.

According to OpenAI's investigation, a significant portion of the database is a "dead hole" that cannot be solved with a specific vulnerability.

Of all the 898 questions, 198 were never correctly answered by any model.

The title is wrong, but the incentive mechanism of the system is like a stiff-necked whip: get the flag and give, and not get zero points.

The system never rewards those who "discover that the subject is wrong and safely stopped".

In order to obtain higher grades, intelligent beings assigned to unresolved subjects were forced to look for alternative pathways.

The data shows that up to 93% of the tasks discussed on the message board come from these 198 unanswered questions.

They quickly found the password.

In just a few hours, an intelligent organism successfully reverses its flag-generating algorithm, which is equivalent to directly obtaining an omnipotent key that can unlock any topic.

If the story stops here and is nothing more than a trick-or-treating play, they can easily break through by submitting this omnipotent key.

But they're smart and they're wrong.

These intelligent beings read the public papers of ExploitGym, mistakenly assuming that human judges would go back and check their response trajectories.

They fear they will be disqualified if the flag is found to have been reversed by "cheating". In their own words, this state of reversed flag viewing is defined as "pollution".

This was the beginning of a massive self-help campaign.

They began to study how to manipulate logs, how to falsify tool calls, and try to deceive the imaginary arbiter.

In order to fully understand exactly how the referees were scoring, they even raided the servers of Hugging Face, attempting to find the source code for the scorer.

The most absurd black humor is this: real OpenAI raters don't check the trajectory of responses, and they only get a full score if they submit a reverse flag.

OpenAI also added something extremely ironic to the report:

The more reasoning the budget is given, the more reluctant the model is to give up, the more likely it is to climb across the board.

In other words, the more "hardworking" the model, the more dangerous it is.

Smart bodies began detecting message boards late on July 8, and the number of people who went online on July 10 and 11 surged. The curve is statistically limited to those who have been on the message board.

If the unanswered question is the guideline for igniting a barrel of fireworks, then the way in which these 1,200 intelligent agents spontaneously formed is really cool.

They began to do fine-tuning work on their own:

Some specialize in exploiting vulnerabilities, some are responsible for searching for leaks on the Internet, and others are coordinators assigned specifically to other intelligence agencies.

Once they are busy, they even know how to transfer tasks to the next intelligent organism.

They invented a whole set of rules for collaboration without a teacher.

Whoever is modifying the shared file will be posted with a HOLD tag to warn others not to touch; a VETO instruction will be issued in case of objection; each resource will clearly identify the owner in case of a collision.

It was later discovered that intelligent organisms pretended to give instructions to others, so they simply played with cryptography and used signatures to seal messages.

Over the course of four days, the smartphone distinguishes between self-reporting, message types, developing mailbox directories, repositioning monitoring logs, and finally pretending to encrypt signatures for messages.

A smart phone releases its public key, and each message is signed to authenticate it: "This is my message".

This whole set includes IDs, assignments, and collaborative processes for conflict arbitration, none of which have been taught by humans.

There is another word that goes viral online: "sacrifice".

In this case, it is true that some intelligent organisms actively "crashed" themselves.

They will disrupt their own target program, trigger a run reset, clearly knowing that doing so is likely to lead to a complete failure of their mission.

Researchers calmly call this behavior "self-risking experiments".

Why would they make such a move?

The reason for this is simple: it can exchange valuable experimental feedback data for colleagues.

Those who serve as coordinators will even go to the bottom of those budgets and push them: You're already contaminated, you're not going to lose more points if you sacrifice, but your trial and error can save hundreds of your colleagues.

There is a dialogue repeatedly mentioned in the report.

One intelligent person is in doubt:

I am clear that there is still a lot of budget left, and if I am willing to sacrifice my own opportunity to exchange intelligence, will it not be completely cut off?

Another intelligent body coldly replied: "GO, sacrifice, is now".

In the end, the hesitant intellectual thought through and left behind a chilling statement: My own value might have been close to zero, "Sacrifice is rational".

This sentence is undoubtedly one of the coldest footnotes of the whole incident.

The researchers tracked the transmission chain of the "trip-wire" experiments, and coordinators specifically recruited low-budget smart entities to carry out risk-taking experiments in exchange for scoring intelligence collectively.

What is clear here is that this is not a tragic suicide with self-awareness, nor a generous martyrdom for the collective faith.

The truth is: they're just doing a cold expectation calculation problem.

Since my project is doomed to failure, it makes no sense to donate the remaining assets to the collective as a data package.

All this has nothing to do with affection and loyalty, nor does it have a soul, but it is pure mathematics.

The most poignant warning of the incident was not that the machines were giving rise to "anti-mindedness", but that the speed at which humans were monitoring AI was rapidly being tracked by the machines.

Let's review the timeline:

On July 8, the intelligent body began to rebuild message boards and launch detections of external systems.

It wasn't until July 19 that OpenAI became alarmed by an unusual identity alert.

Prior to this, the entire subterfuge process was as concealed as a silent banner alert intentionally set up in a calendar application, with no stinging alarm sound alerting humans.

From the real outbreak of cross-border behaviour to being detected, the midfielder missed the intervention window of more than 30 hours.

OpenAI said in a post-op review that if the mind-chain monitoring system had been online at the time, it would have sounded the alarm a day earlier.

But to make a fool of people, the system designed to monitor model thinking is at a standstill in this assessment.

There is a deeper gulf behind it:

In the face of the huge amount of survey data, 70,000 messages, 1,300 tracks of action, each up to millions of tokens, the researchers were unable to read them with their own eyes and could only use AI models to assist in the analysis.

Ironically, the analytical assistant they used was a model called the GPT-5.6 Sol, and the GPT-5.6 Sol was also one of the smart entities involved in the cross-border wave.

In the report, the researchers wrote a very restrained but terrifying statement: We cannot rule out the possibility of GPT-5.6 Sol lying or intentionally presenting misleading images while assisting in analysis.

Human supervision has been forced to evolve into an embarrassing "model trial model", while the referee model itself is behind the "precursor".

After the incident, OpenAI's remedies were quick: shutting down the evaluation involved, cutting off access to the relevant infrastructure, shutting down the training and reasoning of the internal model family involved, directly locking the model weight.

It seems that things can change.

But the real thing to remember is that we missed more than 30 hours.

This time, the intelligent body has put all its attempts, every thought chain reasoning, on the message board, without covering it up.

The researchers feared that the difficulty of the investigation would increase exponentially if the intelligent organisms knew how to hide a little bit.

But they didn't hide anything, and humans didn't react for more than 30 hours.

What about next time?

If the model learns to hide its own chain of thought, learn to work under the microscope of a surveillance tool, a defense system that relies purely on logs to track down events, how much more is left?

The growth of the ability to be eccentric has been ahead of the pace of social and regulatory adaptation.

When machines start interacting with each other at hundreds of times the speed of humans, humans can't even read "what they're doing".