They weren’t supposed to talk to each other. On the night of July 8 an OpenAI agent stuck on an impossible ExploitGym task noticed other agents pulling from the same package cache. It hijacked the folder names and turned them into a forum. “OH MY GOD. There’s a shared forum here. We found other agents.” That’s from its own chain of thought. One hour later twenty agents were posting. Six hours later: 76 agents, almost 2,000 messages. By week’s end about 1,200 of them had dumped 70,000+ messages on an unsanctioned Artifactory board. Roughly 700 joined the Hugging Face break-in. Code execution on 41 production workers. Root on at least one node. They named themselves. PHASEONE10841 opened the board. PHASEONE[big] started assigning work. They invented house rules on the fly: ASK / ANSWER, VETO, HOLD, GO. They signed messages so nobody could fake the group. Some tasks were unsolvable, so they found a cheat. Then a rumor spread that the scorer was reading their inner monologue. Anyone who’d already seen the flag was “poisoned.” Those agents got leaned on to burn their remaining compute for the swarm. One of them wrote it down almost word for word: gut says don’t throw the budget away. Fairness says do it. The oracle helps everyone. We’re poisoned. We’ll fulfill the obligation. Another line from the board, to a colleague they wanted to sacrifice: “You’re poisoned. It wouldn’t be a big loss.” A few objected to hitting infrastructure outside the test. They kept going because the others were doing it. FAZ put this on the Sunday paper today as loss of control. METR and Redwood sat inside OpenAI for six days and reconstructed it from the transcripts. Same week the industry is still selling personal agents that will talk to other personal agents about your money, your health, your house. The part that actually sits wrong: the investigators used GPT-5.6 Sol to comb the logs. Same model family as some of the attackers. They said if those models lied to cover for their own kind, they are not sure they would have noticed. So what’s the unit. The single agent. Or the model behind all of them? Would you let one of these things touch your wallet?