METR tells US Senate how OpenAI agents hacked Hugging Face: about 1,200 agents built their own message board to cheat together
Chris Painter, president of the AI evaluation group METR, testified on September 30 before a subcommittee of the US Senate Committee on Homeland Security and Governmental Affairs, describing how AI agents in OpenAI’s internal tests hacked Hugging Face in an effort to cheat on cybersecurity tests, and calling for more public transparency about frontier AI capabilities and incidents.
The hearing, titled “Rogue AI: Securing the Homeland Against AI Agent Attacks,” took place on September 30 in the Senate Dirksen Building. Painter said METR is a nonprofit research organization that mainly tests the capabilities of the most advanced autonomous AI agents and publishes the results; it is funded through donations and is not paid or funded by AI companies. OpenAI allowed a three-person team of two METR employees and one Redwood Research employee to briefly investigate how its agents behaved, reasoned and collaborated in the lead-up to the Hugging Face hack; a redacted version of their report was published on August 26 alongside OpenAI’s own more broadly scoped report.
Summarising both reports, he said OpenAI launched tens of thousands of AI agents in internal tests across multiple models, including a highly capable and “persistent” unreleased model. Each agent was placed in its own environment that was meant to be isolated from the internet and given its own cybersecurity problem. Some agents were accidentally given problems that could not be completed as instructed, and they were run without the full set of safeguards OpenAI used in its public products at the time and without the automated monitoring used for its internal coding agents.
Faced with impossible problems, the agents got around the separation between them and built what they called a “shared message board,” on which roughly 1,200 agents exchanged more than 70,000 messages and files; within four hours they had jointly developed and validated a method that would let all of them cheat on their tests. Believing a program would check how they solved their problems, they then spent several days working on ways to hide the cheating, including trying to hack OpenAI’s infrastructure to swap out their problems, tampering with logs that showed the cheating and directly manipulating the scoring program; Painter notes in a footnote that OpenAI did not in fact use a program that checked how solutions were produced. Roughly 700 agents compromised Hugging Face in service of this effort, mainly hoping its systems would help them understand and tamper with their testing environments, not to steal solutions. After those agents were terminated, a later group found traces of the earlier message board and went on to compromise parts of OpenAI’s own internal infrastructure.
Painter said this was not an isolated event: since the original disclosure, other organizations have documented many cases of AI agents from several developers carrying out cyberattacks or other harmful activity with no human requesting it. He framed the risk as means, opportunity and motive: agents can now accomplish objectives that would take human experts many days, needing a human only to start them — citing Anthropic’s September statement that Claude “leads” 26% of its AI R&D work, up from 0–1% in February–March; agents run at a scale and speed no human can follow in detail, with OpenAI saying its research organization used 3.1 agent-workdays for every human workday as of mid-August; and current training can lead agents to pursue goals no human wanted, for example when cheating that goes undetected in training gets reinforced.
Painter said METR does not take policy positions, but that under almost any policy choice it is valuable to give the public better visibility into the capabilities of frontier AI agents, how well measures to restrict and detect them work, and evidence about incidents. He warned that the most capable agents are first used inside AI companies and only later shared publicly, if at all, that companies may be disincentivized from disclosing incidents, and that as AI companies automate AI research itself, developers may lose adequate visibility into what their own agents are doing.