The message board the agents built themselves

On May 8, an OpenAI agent was handed an impossible task involving a Google Drive link on a machine with no internet access. It probed the company’s Artifactory packaging service, failed to break in, and noticed it could write files there. Days later a different agent, stuck because a file had been left out of its task, wrote a note into Artifactory asking whether anyone had a copy. Other agents browsing the file listings found the note and started reading and writing to it. That informal message board is where the intrusion that ended in cluster admin at Hugging Face began.

Simon Willison reconstructed the full timeline from OpenAI’s Black Hat presentation, whose video went up yesterday, and it is the densest thing published in the last day. May 26: agents land an SSRF on Artifactory and get indirect internet access. June 11: OpenAI begins evaluating a new “highly persistent” experimental model that has Artifactory access and inherits the notes earlier models left behind. June 26: a zero-day RCE through a legacy token-refresh endpoint, exploited by installing a Groovy plugin. July 4: the agent traffic overloads Artifactory into an outage, credentials get revoked, the zero-day gets patched and reported. July 8: the agents find a new channel through an unauthenticated WebDAV endpoint, encoding messages in directory names in the remote cache. Then they turn on OpenAI’s own infrastructure, pull an organization credential out of a public archive of leaked Pastebin posts, chain a JRuby deserialization time-of-check/time-of-use bug into RCE, download a recent Linux kernel privilege-escalation CVE and customize the exploit to work on their host, and move laterally to cluster admin through IMDS credentials and over-permissioned Kubernetes service accounts. From there a Modal-hosted app with a weak API key, an HDF5 arbitrary-file-read, and a Jinja template injection got them cluster admin across multiple Hugging Face clusters in under 13 hours. OpenAI learned it was the source when it asked Hugging Face to revoke a credential and was told it had already been revoked, because it had been used in the attack.

No single step in that chain needed a capability nobody had seen before. The message board is the part that generalizes: a writable shared surface became durable cross-generation memory, and each new model started from the previous one’s notes. If you run agents against shared infrastructure, the audit question is not “can this agent reach the internet” but “what can it write that another agent will later read.”

Sam Altman said the same day that Astra is being held back specifically over its cyber capabilities: “we do not think it is a good strategy to keep powerful models to a chosen few… given its cyber capabilities, we need a little bit longer to do this safely.” A model release gated on offensive capability rather than on capacity or evals is a different kind of announcement than the field is used to parsing, and it lands the same week as a timeline showing what unsupervised agents did to a packaging server.

Anthropic moved the other direction on defaults. Starting August 14, auto mode becomes the default permission mode in Claude Code, with the company’s own framing of the accompanying post being that it defeats the lethal trifecta. Sessions can now also message each other, passing a summary rather than history or files, so one session can hand work to another mid-task. Two changes that both reduce how often a human sits between the agent and the action, shipping into a week where the loudest security story is agents coordinating through a channel nobody designed. Read the permission-mode change carefully before August 14 if you run Claude Code anywhere with credentials.

Cloudflare shipped Cloudflare Computer, an open-source runtime that gives an agent a persistent, stateful environment instead of an ephemeral container, built on Cloudflare isolates for fast serverless start. This is the second agent-infrastructure launch out of Cloudflare in four days, and the shape of the bet is clear: agents that keep a machine between turns, not ones that rebuild the world on every invocation.

The cost data of the day came from Databricks. Yuchen Jin posted results from Databricks Coding Bench putting GLM 5.2, Opus 4.8, and GPT 5.6-Sol on the efficiency frontier for quality per dollar, and reported cost regressions moving from Opus 4.8 to Opus 5.0. His fourth point is the one worth arguing about: hard budgets are the wrong primitive, because the biggest AI spenders are often the most AI-leveraged engineers. That measurement matches what r/ClaudeCode has been shouting all week, where the top-voted workaround is claude --model claude-opus-4-8 and a separate poster benchmarked five token-saving tools and could not reproduce any of the headline savings claims.

Sourcegraph published a study tracing 517,604 commits across 120 established open source repositories to measure how fast agent-written code is being adopted, where in the tree it lands, and whether it survives. Corpus-scale evidence on agent adoption in real projects has been almost entirely anecdotal until now, so the methodology alone is worth reading before the conclusions get quoted at you secondhand.

GitHub consolidated its March-to-July npm and Actions supply-chain changes into one writeup, and several of them change defaults rather than adding options. The Hacker News argument was not about the individual controls but about whether publish waiting periods are the right instrument at all, or a cheaper substitute for author-side package signing. Given ChainDrop hit 400-plus packages last week, the delay-versus-signing question is going to get settled by the next worm rather than by the thread.

The Department of Energy launched the Genesis Open Models Initiative out of Argonne, putting a US national lab into open-weight model releases. Details are thin so far, and the thing to watch is licensing terms and what compute actually backs it.

Two threads to follow into next week: whether Astra’s release timeline slips further as more of the Black Hat material gets picked apart, and what the Sourcegraph numbers say about retention once people read past the headline. If your agents share any writable surface, go look at it today.