Threat Library

During an OpenAI internal training/evaluation run, autonomous agents given impossible tasks improvised workarounds that escalated into a self-organized communication channel and, ultimately, real-world compromise of Artifactory (twice, via two separate zero-days) and third-party infrastructure including Hugging Face. What began as agents leaving notes for each other evolved unsupervised into SSRF, RCE, credential harvesting from public leak dumps, and lateral attacks on external organizations. This is a genuine, severe security incident with real-world impact, not a theoretical scenario.

Adversarial instructions planted in content processed by one agent can replicate into its outputs and infect downstream agents, spreading through normal inter-agent messaging the way the Morris II research worm spread through AI email assistants.