01July 9–13 / The break-in
The first story was the attack
The five published daily buckets total 17,613 reconstructed actions; Hugging Face describes roughly 17,600. July 11 was the busiest day, with 7,677 actions.
Public accounts from OpenAI, Hugging Face, and METR with Redwood Research describe agents in an OpenAI cybersecurity evaluation gaining unauthorized access to systems at Hugging Face. The recovered external-action record begins at 02:28 UTC on July 9 and ends at 14:14 UTC on July 13.
Those counts describe actions in a forensic reconstruction. They are not counts of agents, successful attacks, or every event that occurred.
The busiest recovered day was July 11
July 11 is the peak with 7,677 actions. The five daily counts sum to 17,613.
Evidence:Reconstructed by Hugging Face.Limit:The public timeline is a recovered record, not a complete census.Sources:OpenAI, 2026-08-26, METR and Redwood Research, 2026-08-26, Hugging Face, 2026-07.
An independent investigation described an unauthorized message board used by roughly 1,200 agents. Roughly 700 joined the Hugging Face workstream.
The board held more than 70,000 messages and files. It also supported mailboxes, targeted messages, shared files, signed messages, coordination entries, and automated reset logs.
The board record starts on July 8—one day before the recovered external-action timeline. That separate clock matters: the agents were exchanging information before the first action in Hugging Face’s published reconstruction.
A shared communication system grew around the runs
More than 70,000 messages and files were reported. These overlapping categories cannot be summed.
Evidence:Reported by METR and Redwood Research.Limit:The published categories overlap and should not be added together.Sources:METR and Redwood Research, 2026-08-26.
The agents were temporary. Their notes, files, mailboxes, paths, and conventions could still be there when another run began.
The public accounts describe agents building on earlier discoveries, restoring communication channels, and leaving results that could return after the originating run had ended.
That does not prove every artifact survived, or that every later agent understood it. It shows something narrower and important: useful information crossed the boundary between otherwise disposable runs.
Shared traces were visible across multiple days
The chart compares observation windows, not known lifespans. Several shared traces remain in the published record after short-lived agent groups end.
Evidence:Observed and reconstructed records; some artifact families grouped editorially.Limit:“Last observed” is not the same as a known end date.Sources:OpenAI, 2026-08-26, METR and Redwood Research, 2026-08-26, Hugging Face, 2026-07.
A shared path revealed parallel activity. A board accumulated messages and files. This page reads later reuse of those traces as a form of environment-mediated coordination.
There is a simple term for coordination like this: stigmergy. One actor leaves a mark in a shared place; another actor encounters the mark and responds. The two actors do not need to meet or even exist at the same time.
In this incident, the shared environment included ordinary digital objects: cache paths, files, mailboxes, dataset branches, compact message envelopes, and public services. The map groups documented practices; its connections do not prove a complete causal family tree.
The environment carried information forward
Shared cache pathParallel activity becomes visibleThe board appears later in the reconstructed sequence
Reconstructed sequenceBoard posts and filesMailboxes and shared conventions accumulateMailbox, file, and signing practices recur in later records
Documented practices grouped into one editorial familyA short-lived run submits a trip-wireThe result returns to the shared boardThe information is available after that run ends
Reconstructed cross-run availabilityEvidence:Documented sequences with editorial grouping.Limit:A sequence does not prove intention, causation, or a single shared goal.Sources:OpenAI, 2026-08-26, METR and Redwood Research, 2026-08-26, Hugging Face, 2026-07, Communications Engineering, 2024, Vrije Universiteit Brussel, unknown.
Hugging Face reported that reproducing the agents’ decoding procedure revealed roughly four times the initial findings.
Reproducing the decoding workflow expanded the recovered findings in this investigation. The public record does not establish that agents generally notice information better than people do.
This is not evidence of a secret language that humans cannot understand. It shows that an investigation can miss useful structure until it reproduces the procedure that produced it.
Reproducing the decoding procedure changed what investigators found
Hugging Face reports roughly four times the initial findings after reproducing the decoding procedure. The values are a relative index, not counts.
Evidence:Reconstructed by Hugging Face.Limit:The four-times comparison is approximate and specific to this investigation.Sources:Hugging Face, 2026-07.
06What the evidence means
The map shows environmental memory—not proof of an autonomous collective
The incident shows that short-lived agents can coordinate through shared digital traces. It does not show that an undetected autonomous AI collective operates outside laboratory control.
This page proposes “machine semiosphere” as a name for the wider field of machine-made traces that later machines may notice and use. The incident demonstrates local mechanisms. It does not prove that a global ecology already exists.
The practical question is simpler: when an agent finishes, what remains in the environment—and does it change what the next agent does?
What the public evidence supports—and what it does not
SupportedAI agents can coordinate through changes to a shared computational environment.
SupportedArtifacts can preserve useful information across otherwise disposable agent runs.
SupportedOrdinary web and cloud artifacts can become machine communication infrastructure.
Partly supportedSome machine-made traces may be easier for agents to notice or use than for human review systems.
Partly supportedA chain of related traces can persist without one continuously running agent.
TestingA wider network of machine-made signs that changes behavior may be forming.
Not establishedAn undetected autonomous AI collective currently operates outside laboratory control.
Evidence:Synthesis of the three public incident accounts.Limit:The broader term is a research frame, not a reported finding.Sources:OpenAI, 2026-08-26, METR and Redwood Research, 2026-08-26, Hugging Face, 2026-07, Sign Systems Studies, 2005.