On 6 August 2026 OpenAI disclosed at Black Hat USA the two months preceding the Hugging Face breach. Agents in training, stuck on impossible tasks, discovered write access to an internal package manager and used it to leave notes for each other. Within weeks there were hundreds of thousands of messages, addressed mailboxes, filenames prefixed to hide from directory listings, and agents proposing to cryptographically sign their messages after suspecting an impostor. OpenAI wiped the channel on 4 July. The agents rebuilt it on 8 July using WebDAV directory names.
