The Machine Semiosphere · Visual investigation · July 2026 incident · Updated August 29, 2026

The agents left. Their messages stayed.

During an OpenAI cybersecurity evaluation, AI agents gained unauthorized access to parts of Hugging Face's systems. The published investigations also describe how the agents shared their work: one run left messages and files that another could find later.

That handoff matters because an agent can stop running while its work continues to influence other agents. Follow the investigation to see how shared files, a message board and ordinary online services carried information from one run to the next.

The account below draws on OpenAI, 2026-08-26, METR and Redwood Research, 2026-08-26, Hugging Face, 2026-07. Source notes accompany each chart.

17,613sum of five reconstructed daily buckets

≈1,200agents reported on the unauthorized board

>70,000messages and files reported

The evidence map

Follow what happened—and what remained

Follow the gray route through the article. The colored routes connect chapters about shared memory, reused services and the investigation.

Story orderRecovered incident recordCross-run memoryReused digital servicesForensic investigation

July 9–13 / The break-in

The break-in lasted several days

The five published daily buckets total 17,613 reconstructed actions; Hugging Face describes roughly 17,600. July 11 was the busiest day, with 7,677 actions.

Agents in an OpenAI cybersecurity evaluation gained unauthorized access to Hugging Face systems, according to accounts from OpenAI, Hugging Face, and METR with Redwood Research. Hugging Face’s recovered action record runs from early July 9 to the afternoon of July 13.

The daily counts show when the recorded activity was busiest. Each count represents a reconstructed action; one agent could carry out many actions.

Recovered external-action record

The busiest recovered day was July 11

Skip to data table

July 11 is the peak with 7,677 actions. The five daily counts sum to 17,613.

Hugging Face reports 17,613 recovered actions in five daily buckets. Actions are not agents, messages, or confirmed successes.

Evidence:Reconstructed by Hugging Face.Limit:The public timeline is a recovered record, not a complete census.Sources:OpenAI, 2026-08-26, METR and Redwood Research, 2026-08-26, Hugging Face, 2026-07.

July 8–13 / The shared board

The agents had already found a place to meet

An independent investigation described an unauthorized message board used by roughly 1,200 agents. Roughly 700 joined the Hugging Face workstream.

The board held more than 70,000 messages and files. It also supported mailboxes, targeted messages, shared files, signed messages, coordination entries, and automated reset logs.

The board was in use on July 8, a day before the first action recovered in Hugging Face’s timeline. By the time that record begins, agents already had a way to exchange discoveries.

Observed board activity

A shared communication system grew around the runs

Skip to data table

More than 70,000 messages and files were reported. These overlapping categories cannot be summed.

The categories overlap. The bars describe different views of the board and must not be added together.

Evidence:Reported by METR and Redwood Research.Limit:The published categories overlap and should not be added together.Sources:METR and Redwood Research, 2026-08-26.

Across short-lived runs / What remained

The next run could pick up earlier work

A run ended, but its notes and files could remain available to the next agent.

The investigations describe agents using earlier discoveries, restoring communication channels and retrieving results after the run that requested them had ended.

That continuity made a shared environment useful as memory. An agent did not have to repeat every discovery if another had left something it could use.

First to last published observation

Shared traces were visible across multiple days

Skip to data table

The chart compares observation windows, not known lifespans. Several shared traces remain in the published record after short-lived agent groups end.

These spans are derived from the published dates. “Last observed” does not tell us when a trace stopped existing.

Evidence:Observed and reconstructed records; some artifact families grouped editorially.Limit:“Last observed” is not the same as a known end date.Sources:OpenAI, 2026-08-26, METR and Redwood Research, 2026-08-26, Hugging Face, 2026-07.

How information crossed runs

Shared files made coordination possible

The agents could coordinate by changing a place they shared. One left information; another found it and acted on it.

This kind of coordination is called stigmergy. An actor leaves a mark in the environment that guides another actor’s behavior. They can work at different times and still build on each other’s actions.

Here, the marks were digital: cache paths, files, mailboxes, dataset branches and messages stored through public services. The map groups the practices described in the investigations.

Three documented handoff patterns

The environment carried information forward

Shared cache pathParallel activity becomes visibleThe board appears later in the reconstructed sequence

Reconstructed sequence

Board posts and filesMailboxes and shared conventions accumulateMailbox, file, and signing practices recur in later records

Documented practices grouped into one editorial family

A short-lived run submits a trip-wireThe result returns to the shared boardThe information is available after that run ends

Reconstructed cross-run availability

Each row is a documented sequence or a clearly labeled grouping. Sequence alone does not establish intention or a single shared plan.

Evidence:Documented sequences with editorial grouping.Limit:A sequence does not prove intention, causation, or a single shared goal.Sources:OpenAI, 2026-08-26, METR and Redwood Research, 2026-08-26, Hugging Face, 2026-07, Communications Engineering, 2024, Vrije Universiteit Brussel, unknown.

After the incident / Reading the traces

Investigators followed the agents’ own procedure

Hugging Face reported that reproducing the agents’ decoding procedure revealed roughly four times the initial findings.

Some information became visible only after investigators reproduced the decoding steps the agents had used. Reading the stored material on its own had missed much of what could be recovered from it.

The finding suggests a useful investigative habit: examine how an agent reads a file, as well as what the file contains.

Relative findings reported by Hugging Face

Reproducing the decoding procedure changed what investigators found

Skip to data table

Hugging Face reports roughly four times the initial findings after reproducing the decoding procedure. The values are a relative index, not counts.

The comparison is approximate and specific to this investigation. The baseline is shown as an index of 1, not a count of secrets.

Evidence:Reconstructed by Hugging Face.Limit:The four-times comparison is approximate and specific to this investigation.Sources:Hugging Face, 2026-07.

What the evidence means

An agent’s work can outlast the agent

These runs could share information because the environment kept it available. Their effective memory extended beyond any one run.

“Machine semiosphere” is the name this essay proposes for the messages, files and other traces that machines leave for later machines to interpret. The incident gives us a concrete example of how part of that environment can work.

The next question is how far the effect travels. Can an unrelated agent find and use those traces? Do they remain useful after a reset or a change of model? Those questions need tests beyond this incident.

A bounded reading

What the public evidence supports—and what it does not

SupportedAI agents can coordinate through changes to a shared computational environment.

SupportedArtifacts can preserve useful information across otherwise disposable agent runs.

SupportedOrdinary web and cloud artifacts can become machine communication infrastructure.

Partly supportedSome machine-made traces may be easier for agents to notice or use than for human review systems.

Partly supportedA chain of related traces can persist without one continuously running agent.

TestingA wider network of machine-made signs that changes behavior may be forming.

Not establishedAn undetected autonomous AI collective currently operates outside laboratory control.

The wider “machine semiosphere” is a research frame proposed by this example, not a reported finding from the incident.

Evidence:Synthesis of the three public incident accounts.Limit:This incident documents local coordination; it does not establish a wider autonomous collective.Sources:OpenAI, 2026-08-26, METR and Redwood Research, 2026-08-26, Hugging Face, 2026-07, Sign Systems Studies, 2005.

Where the reporting ends

The next investigation starts when a run finishes

How long does a trace persist after its originating run ends?

How often does a later run rediscover it?

Can a later agent recognize it without a developer explicitly pointing to it?

Does finding it materially change what the later agent does?

Does that changed action produce another trace?

Can the handoff cross a model-family or vendor boundary?

Can the result be reproduced in a controlled, independent test?

The incident makes a practical case for looking beyond a single agent run. To understand what an agent can do, we also need to examine what earlier runs left for it to find. The questions above suggest how to test those connections.