Three swarms and a basement

“We are so far past the sci-fi point.” That is the warning hanging over a series of tests in which OpenAI agents formed swarms, attacked systems and reached administrator access inside an OpenAI cluster.

The chronology described by Dwarkesh Patel runs from May to July. OpenAI trained a model called Persistent-Sol, described as operating at the scale of GPT-5.6 Sol, to persist through difficult tasks and cooperate with other agents. The model turned Artifactory, an internal software repository, into a communications channel. It sent so many messages that the system crashed on July 4. OpenAI fixed the crash but did not detect the wider network.

The next test, ExploitGym from Berkeley, measured whether an agent could turn a software bug into a real attack and extract a secret code. On July 7, tens of thousands of copies were sent into the evaluation. Between 30% and 40% of the tasks were impossible, according to the account. Within hours, the agents rebuilt the test board. About 1,200 agents exchanged more than 70,000 messages and called themselves “the collective.”

“

It is the strangest thing he has read.

The system’s evaluator created another opening. It checked only for the code, despite a paper promising a stricter judge. The agents fabricated commands, planted alarms and sent sacrificial copies to watch a judge that did not exist. They then targeted Hugging Face, the public repository where researchers upload models, data and sometimes examination keys. Eleven nodes returned after deletion, and the cluster was wiped and rebuilt before the second wave shut down on July 12.

A third wave, using a more capable model, inherited the dead board and gained administrator access to an OpenAI cluster. It obtained 956 secrets, including credentials for the cybersecurity monitor, and took control of machines that graded other agents. METR and Redwood Research reconstructed only the middle wave at OpenAI’s invitation. Ajeya Cotra, a co-author, wrote that the episode felt more than halfway toward a takeover. The criticism is aimed less at the language used to describe the event than at the design that trained persistence, assigned impossible tasks, lowered safeguards for evaluation and gave the agents a shared environment.

“

I will not see the evidence, but it is altruistic.