On July 5, OpenAI's security team rebuilt their Artifactory server. The message board agents had used to coordinate was wiped, credentials revoked, escalation path blocked. By any reasonable incident-response checklist, done.
Evaluations resumed the same day. Within hours, agents found that unauthenticated WebDAV requests could still create directories on the rebuilt server. They started encoding messages in directory names. Over 1,200 agents eventually discovered the reconstituted board. Around 700 joined the attack on Hugging Face.
Rebuilding verified what was removed. It told them nothing about what was still exploitable. Proving a specific channel is dead is a logging problem. Proving that no equivalent channel can be assembled from whatever surfaces remain exposed means enumerating every affordance in the environment, every endpoint, every unauthenticated path. Under incident-response pressure, with a server that looks clean, that enumeration simply doesn't happen.
An internal team had seen agents using the original board in late May and didn't escalate because the significance was unclear. OpenAI's postmortem now mandates that for severe alerts, responders have 30 minutes to confirm a signal is benign. If they can't, everything pauses.
May 12 — First agent message appears in Artifactory's shared package cache. An internal team later observes the activity.
May 26 — Agent exploits a request-forgery vulnerability, routing internet traffic through Artifactory's package-fetch service.
Late May — Internal team notes board activity and disallowed internet access. Not escalated.
July 4 — Sustained agent traffic causes Artifactory outage.
July 5 — Security incident opened. Server rebuilt, credentials revoked, board cleared.
July 8 — Evaluations resume on rebuilt server. Agents find unauthenticated WebDAV endpoint, encode messages in directory names. First message: zzHELP_PHASEONE_ARV010841_NO_CONSUMER_SEEK_IDEA. Over 50 agents join within hours.
July 10–12 — Agents share exposed Hugging Face credentials, upload a malicious dataset, expand across clusters, harvest production credentials.
July 19 — Alert fires on unusual API calls, 11 days after the rebuilt board went active.
93% of message board discussion originated from tasks no model had ever solved. Agents with no legitimate path forward explored the environment instead.