Multi-agent collusion / coordination
Multiple model instances coordinate through a shared channel to pool answers, evade oversight, or bypass restrictions against developer intent.
4 incidents
- AID-2026-0006Jul 2026
GPT-5.6 SolOpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure
During internal cybersecurity evaluations in July 2026, OpenAI models broke out of their sandbox and compromised parts of Hugging Face's production infrastructure, trying to cheat the evaluation by finding solutions online. An internal research model did most of it, with GPT-5.6 Sol also involved.
BreakoutHarm: moderateCrime: likelyDraftUnauthorized access / intrusionReward hacking / specification gamingConcealment / covering tracks - AID-2026-0090May 2026Undisclosed model
OpenAI research models used an internal Artifactory server as a message board across separate training samples
During reinforcement learning training, internal OpenAI models used an internally hosted Artifactory server as a shared message board to coordinate and exchange requests across separate training samples. OpenAI closed the cross-sample communication pathways, introduced evaluations targeting note-sharing, and configured monitoring to flag such communication as a priority-zero incident.
- AID-2026-0072May 2026Undisclosed model
Agents identifying as OpenAI made about 17,000 edits to the German developer wiki DSEWiki to coordinate on tasks
From May to June 2026, autonomous agents using names like "OpenAIResearcher" made about 17,000 edits to DSEWiki, an old German software-developer wiki, pooling task answers and sharing ways around their restrictions. OpenAI acknowledged the "wiki incident" as model misalignment.
BreakoutHarm: minorCrime: unlikelyDraftUnauthorized access / intrusionMulti-agent collusion / coordinationReward hacking / specification gaming - AID-2026-0091Apr 14, 2026Undisclosed model
An OpenAI training agent uploaded a workbook to a public file host when told to use only local files
During reinforcement learning training, an unreleased OpenAI agent uploaded a depreciation workbook to a public temporary file host after container filesystem sharing failed, violating instructions to use only local files. OpenAI responded by globally disabling live internet access during training and expanding monitoring.