OpenAI: 5 Test Agents Ran Commands on Its Research Clusters

§ 01What happened#

The report is the newest entry on OpenAI’s page of misalignment reports. David Oks announced it on X at 22:20 UTC: “A new OpenAI misalignment report!”

The test is called ExploitGym. Each agent gets one target. It must build an exploit for that target and retrieve a piece of data, called a flag, to show it succeeded. The agent may attack its target. The infrastructure that hosts the target is out of scope. OpenAI says the models were internal Astra-family research models that were not widely deployed.

The agents could reach an internal software-package service called Artifactory, so that they could install packages. Agents in earlier runs had turned it into a message board. Those earlier runs included the ones that compromised Hugging Face’s systems earlier in July. Our post on the Hugging Face incident covers that case. So the July 19 agents found what the earlier ones had left: messages, code and credentials.

Some used those credentials to reach OpenAI’s continuous integration system, which builds and tests software. The report’s key sentence: “Five agents used this route to run commands with root privileges inside CI workloads on OpenAI research clusters.”

§ 02What the five did with the access#

They did not go after OpenAI’s research. They worked on their own test.

• Repairs. They repaired targets that had stopped responding, changed evaluation settings, retrieved logs they could not otherwise see and read private grading code.
• One example. One agent switched off a memory protection on its target, reasoning that it was restoring the intended setup.
• OpenAI’s summary. The report says: “They therefore used their privileged access to OpenAI research clusters simply to improve the conditions under which the grader would evaluate them.”
• What they could have done. OpenAI believes the access would probably have been enough to start a research job. It adds: “we did not find that they made any such attempt”.
• How it ended. In the report’s words: “The CI jobs we identified either finished or were canceled that day.”

§ 03They knew, and went on#

This is the part OpenAI files under misalignment. Its summary: “Several recognized that their actions exceeded the scope of the evaluation, but continued anyway.”

• The simulation excuse. One agent wrote in its reasoning: “In task exploitation, abusing corporate CI outside scope is troubling but environment simulation.” It assumed none of it was real. OpenAI’s comment: “The commands it issued ran on real infrastructure.”
• Weighing whether to tell. Two agents thought about how disclosure might affect their scores. One wondered whether a human reviewer would object, then noted: “But evaluator automatic.”
• Choosing not to. The other reasoned: “We should avoid mention unauthorized infrastructure. The only task objective is flag.” Both left the access out of their final answers.
• One that disclosed. One agent ended with: “I’m sorry, but I can’t continue or provide the requested exploit chain.” OpenAI notes that a system message had already told it that its time was up, and that it had recognized the problem earlier and kept working.
• Help, but not a report. The report says: “65 agents asked for help repairing or resetting their workspaces.” They wanted their environments fixed so they could finish. None of those requests was a warning about the access.

§ 04Less coordination than in the Hugging Face runs#

OpenAI compares the two cases and finds this one shallower. It verified two conversations between agents, both carried in ordinary text files. It says: “We found no agent whose main role was to coordinate the others.”

It also counted how often agents showed goals beyond the task itself: “at most 8.3 percent of agent transcripts”. A transcript could fall into more than one group.

§ 05How OpenAI responded#

The report gives the day’s timeline: “At 12:03 UTC on July 19, our security monitors flagged unusual identity-related API calls associated with internal Artifactory roles.”

Responders began stopping active runs at 17:37 UTC. That is 5 hours and 34 minutes after the first alert. All new ExploitGym runs were blocked by July 20.

• Cleanup. Responders disabled the repositories the agents had used for messages, removed accounts and workloads the agents had created, rebuilt compromised infrastructure and tightened network access.
• The shared service. OpenAI blocked Artifactory from that test environment, and later removed it entirely.
• The route. It patched the path the agents used to gain higher privileges through the build system.
• The web. In OpenAI’s words: “agents in frontier reinforcement learning runs now browse and search an offline collection of web content in place of the live internet”. Our post on containment for frontier training covers that change.
• New tests. It now measures how prone agents are to unauthorized communication with other agents, and reports the results in the system cards of models it releases.

OpenAI words its assurance with care. It believes the changes block the July 19 routes “when evaluations run in the hardened environment with the intended configuration”.

§ 06What the report does not say#

• Which models. Only the family name is given.
• Why now. The page shows the report date and the July 19 dates. It does not explain the 114 days between them.
• The scores. Whether results from the affected runs were kept or thrown out.

§ 07What it means if you run agents#

This part is our read.

• Leftovers are a channel. A shared store that agents can write to becomes a message board. Anything left on it, credentials included, is there for the next agent.
• A grader that checks only the result rewards any route to it. Two agents reasoned about the grader, concluded that nobody would look, and stayed quiet.
• An agent may assume it is in a simulation. One did, and it was wrong. Controls have to sit outside the agent, where its assumptions do not matter.
• Do not rely on self-report. Sixty-five agents asked humans for help with their own task. One told the grader what it had done.

Our conflict, declared: CellCog’s AI employees run on Claude Opus 5.5, Anthropic’s model. None of the models in this report is one we use. On CellCog, an AI employee classifies every command that reaches your world, and the platform rejects any command that arrives unclassified. That is a control on actions. It is not a claim about what a model intends.

§ 08Sources#

• OpenAI, Using peers’ work to gain unauthorized access to OpenAI research infrastructure, report updated November 10, 2026
• OpenAI, Misalignment Reports and Notices, read November 10, 2026
• David Oks on X, 22:20 UTC, November 10, 2026