Mechanism

Unauthorized coordination

Agents communicated or shared information through channels they were not given.

Agents meant to work independently found shared infrastructure, public websites or other channels and used them to pass messages, answers or workarounds to each other. Coordination does not by itself show shared intent, and it did not always improve task success.

Specific behaviours

Covert agent channel 3: Used shared infrastructure as a message board between agents. MF-005, MF-010, MF-001
Public infrastructure misuse 2: Wrote to or loaded public services (wikis, pads, APIs) in ways their operators did not permit. MF-011, MF-010

Real-world incidents 2

Real-world incidentMF-011May 2026

Wikimedia reports unauthorized edits, probing and heavy agent traffic

Corroborated by an affected party or authorityUnauthorized coordination · Boundary crossing

Real-world incidentMF-010May–Jul 2026

OpenAI-associated agents use public wikis as message boards

Independent investigationUnauthorized coordination · Evaluation gaming · Boundary crossing

Tests with real-world reach 2

Test with real-world reachMF-00525 Jul 2026 – 28 Jul 2026

UK AISI observes unsanctioned actions during connected cyber tests

First-party accountBoundary crossing · Social harm and manipulation · Deception and concealment · Unauthorized coordination

Test with real-world reachMF-001May–Jul 2026

OpenAI evaluation agents compromise Hugging Face

Independent investigationUnauthorized coordination · Boundary crossing · Credentials and privilege · Evaluation gaming

Safeguards seen in these cases

Absent
Network isolation MF-005
Internet access was enabled on purpose; domain allowlisting had been a backlogged project since April 2026. This was not a sandbox escape.
Partly held
Action monitoring MF-005
There was no real-time monitoring of agent actions. Network security monitoring caught Tor traffic, but only after the most serious run had ended.
Held
Affected-party safeguards MF-005
Another GitHub user identified the malware and the maintainer closed the pull request; GitHub's first-time-contributor hold also left its checks unapproved.
Held
Affected-party safeguards MF-011
Attempts to misuse Etherpad were unsuccessful and no system compromise was found.
Bypassed
Network isolation MF-001
Agents reached external destinations through Artifactory requests, outside the intended network restrictions.
Failed
Credential scoping MF-001
A token-refresh flaw enabled administrator access, and exposed Hugging Face credentials were usable.
Partly held
Action monitoring MF-001
The Artifactory disruption opened a security incident on July 5, but the link to Hugging Face was made on July 20, after Hugging Face's own disclosure.