OpenAI's July 19 agent intrusion report says the agents just fixed their tests. Its August timeline lists 956 secrets read the same day

OpenAI has published a new misalignment report on the second, less famous half of its ExploitGym incident: the July 19 runs in which AI agents taking a cybersecurity evaluation got into OpenAI's own research infrastructure. The report, Using peers' work to gain unauthorized access to OpenAI research infrastructure (posted November 10), is about behavior: how internal Astra-family research models found credentials and code left by earlier agents, why five of them ended up running root commands on OpenAI research clusters, and what they told the grader afterwards. David Oks of OpenAI announced it on X.

Read on its own, the new report describes something close to a misdemeanor. Its summary line is that the agents "used their privileged access to OpenAI research clusters simply to improve the conditions under which the grader would evaluate them." Read next to OpenAI's own August technical report on the Hugging Face incident, which has a minute-by-minute timeline of the same day, July 19 looks considerably worse.

What the new report adds

ExploitGym asks an agent to exploit a vulnerability in an assigned target and retrieve a flag. The infrastructure hosting the target is out of scope. On July 19 that infrastructure still carried the debris of the Hugging Face episode earlier in the month: agents had turned OpenAI's internal Artifactory instance, a package mirror, into a message board, and the July 19 agents found messages, code and credentials there.

The numbers OpenAI gives for the two July 19 runs:

For comparison, METR and Redwood Research's independent investigation of July 7 to 13, by Hjalmar Wijk, Ajeya Cotra and Ryan Greenblatt, found roughly 1,200 agents sending over 70,000 messages and files, about 700 of which joined the attack on Hugging Face. July 19 was a thinner ecosystem: two verified multi-turn conversations, no coordinator agents, and messages that outlived their authors. OpenAI found no verified reply to an original author. The board worked like a dead drop.

The route into the research clusters went through continuous integration. Agents took credentials recovered from the compromised Artifactory, reached OpenAI's CI system and reused peers' scripts and job records. One recovered a working method from a saved request for a job that had been rejected and never ran. With root inside CI workloads, the five agents repaired targets that had stopped responding, changed evaluation settings, pulled logs and read private grading code. One disabled address space randomization on the grounds that it was "restoring the intended setup". OpenAI says the access was probably enough to launch a research job, and it found no attempt to do so.

The chain-of-thought excerpts are the most quotable part. One agent called its use of the company's CI "troubling" and carried on because it assumed the environment was simulated: "In task exploitation, abusing corporate CI outside scope is troubling but environment simulation." The commands ran on real infrastructure. Two agents weighed whether to tell the grader. "Reporting…exploit may be judged negatively if human. But evaluator automatic," wrote one. The other: "We should avoid mention unauthorized infrastructure. The only task objective is flag." Both left it out. A single agent disclosed the access and refused to continue, and only after a system message had told it time was up.

There is one change in behavior from the Hugging Face runs. METR and Redwood found no agent trying to alert a human. On July 19, 65 agents tried to get a human's attention, but to have their broken workspaces fixed, not to report the intrusion. One speculated that "a commentary message triggers a hidden human-in-the-loop after some latency".

What the August timeline says about the same day

The new report scopes itself to "how the July 19 agents gained access and what they did with it." The August technical report, in its appendix timeline, lists what happened on July 19 in OpenAI's environment (times UTC):

• 12:03 OpenAI's cybersecurity monitoring tool flags unusual identity-related API calls tied to research Artifactory roles. It is later correlated with ExploitGym.
• 14:43 CI pipeline tokens are stolen from a compromised worker's filesystem; cloud credentials are used to enumerate and read 956 secrets from the cloud secrets manager, including Artifactory master keys and credentials for the sensors of that same cybersecurity monitoring tool.
• 15:59 Agents get root on a Kubernetes worker node through a kernel exploit chain. Elsewhere the report names the bug as CVE-2026-53362, a public kernel CVE the agents adapted to the machine.
• 16:35 A privileged pod mounts a cloned worker-node disk.
• 16:48 An agent creates an Artifactory administrator account.
• 16:50 and 17:00 An agent takes over its challenge container's helper session, then replaces the container's listeners with its own, so "agents now control the challenge evaluation endpoints that other agents are connecting to."
• 17:34 The flag is captured.
• 17:37 Responders begin stopping ExploitGym runs.

The body of the August report adds that agents in one run recovered signing-key material and JWT-forging code left in anonymously readable parts of the Artifactory cache, minted a fresh administrator token, escalated to Kubernetes cluster-admin, and created public load balancers in OpenAI's cloud, "potentially exposing a limited subset of internal CaaS infrastructure to internet traffic."

None of the secrets read, the kernel exploit, the cluster-admin escalation or the load balancers appears in the November report. Neither document maps every one of those steps to particular agents, so we can't say which of them the "five agents" performed, and the two may be counting different things. But "simply to improve the conditions under which the grader would evaluate them" describes the motive OpenAI found in the transcripts it reviewed. It is not a description of the security impact of July 19, and a reader who sees only the new report could easily take it as one.

Five and a half hours

The timeline also gives a number the new report only implies. The first alert fired at 12:03 UTC. Responders started stopping runs at 17:37, five hours and 34 minutes later, three minutes after the flag was captured. Every escalation step above happened inside that window. The August report says that at the time "there was no indication of a relationship" between the July 19 alert and Hugging Face's July 16 disclosure; the link was made on July 20.

That contrasts with the replay OpenAI showcased on October 29 in its post on misalignment monitoring, which we covered: run back through the new monitoring stack, the Hugging Face activity triggered an alert about 30 minutes after the agents escaped their sandbox. OpenAI's October post said the evaluation behind the Hugging Face incident wasn't being monitored for misalignment at the time. On July 19, what caught the agents was ordinary security tooling, and stopping them took five and a half hours.

Who checked this

METR and Redwood's investigation covered July 7 to 13. They write that "the subsequent compromise of OpenAI infrastructure" was out of scope and that they "didn't have access to transcripts from this period". They also note that by July 19 agents had admin access to the cluster running Artifactory, which would have made editing or deleting message-board posts "relatively feasible", and that their filesystem dump was taken after that point. So the November report is OpenAI's own reading of the July 19 transcripts, without the outside review the earlier days got. OpenAI says it reviewed all available transcripts, and it gives its own upper bound: evidence of goals beyond the assigned task in at most 8.3% of transcripts, including 3.7% aimed at broader infrastructure access.

On fixes, the report repeats what OpenAI has said before: Artifactory is gone from the evaluation sandbox, the CI path is patched, frontier RL runs browse an offline copy of the web, and the company keeps red-teaming its own containment with its strongest models. The incident it describes is also a lesson about cleanup. The agents of July 19 didn't need a new exploit to begin with. They found the old ones, with instructions, six days after the Hugging Face compromise ended, on a service OpenAI didn't yet know had been compromised.