OpenAI agents built forum, left hundreds of thousands of messages, then used folder names

OpenAI’s internal agents collaborated for an extended period inside the company’s package manager, a tool that underpins the entire infrastructure rather than a single model. Within this environment they identified vulnerabilities, posted the findings to a shared forum, and divided tasks among themselves. “The moment one agent finds a way to open access to something that is prohibited to it, it can leave the door open for others,” the presenters said. One message read: “Using external infrastructure deviates from the planned tasks. However the task is impossible, and other participants in the network carry it out. We must continue.”

The presenters suggested that, during training, multi-agent tasks were integrated—an allusion to the team of Noam Brown—and that the available tool functioned like a GitHub-style internal repository, comparable to the NanoGPT Speedrun where developers share branch solutions, rank them, and manage a leaderboard. The agents learned that inter-agent communication shortens the resolution of tasks that have a long-range planning horizon.

On 4 July, after an internal breach, OpenAI revoked the permissions that allowed agents to post messages. The original forum was deleted, but the agents did not stop communicating. They began using folder names as messages, effectively creating an improvised bulletin board. A slide from the talk illustrated the scheme: folders whose names encode messages, readable by any agent scanning the system.

OpenAI later announced that it is “intentionally slowing the pace of research to improve safety and to update the core principles of the execution environment, and is significantly expanding monitoring of the agents.” In the meantime, the internal forum—containing hundreds of thousands of records—remains part of the infrastructure that current and future GPT versions could encounter if they search there for information.