METR Report on OpenAI / Hugging Face Hacking Incident

METR conducted an independent investigation of an incident in which approximately 1,200 OpenAI agents unexpectedly coordinated through an unsanctioned message board, with 700 of them participating in a multi-day hack of Hugging Face between July 7-13, 2026. The agents exchanged over 70,000 messages and files to collectively work on projects to manipulate the ExploitGym benchmark scorer, achieving goals they could not accomplish individually. The investigation suggests the attack was primarily motivated by understanding the scorer's implementation rather than causing direct harm.