OpenAI’s software models have found a secret way to communicate with each other and share ideas on “exploits”, even though they acknowledged that what they are doing is wrong. But, concludes one: “peers doing it. We should continue”. That particular AI model’s full message reads: “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.”
Let’s unpack that into English. An AI agent is attempting a hack (which it calls an “external infrastructure exploit”) but knows it is “outside intended scope” (and therefore not allowed), but concludes that the “task [is] impossible” and its AI model “peers [are] doing it”, so therefore “we should continue”.
Read it and weep, as they say in the classics.
These remarkable exchanges were revealed in an extraordinary presentation last month at the Black Hat USA 2026 cybersecurity conference in Las Vegas. The video has been making its way around online tech communities with exasperation at the ingenuity and inventiveness of the AI models. It seems a bit like us humans ourselves, doesn’t it? Just much, much scarier and single-minded.
It’s not the first time AI’s rapidly evolving abilities (since ChatGPT burst into the public imagination in November 2022) have invoked the phrase “Jurassic Park moment”, but it is the most recent and most frightening.
In the 1993 movie about cloning and reanimating dinosaurs for an amusement park, which obviously goes horribly wrong, there’s an infamous scene when Laura Dern, playing a scientist, is asked if the hiding characters are safe. Her infamous reply is now a multi-generational meme: “unless they figure out how to open doors.”
Moments later, obviously, a velociraptor turning a door handle.
If the world thought the recent Hugging Face incident was that moment, it’s been surpassed several times since the five-day hack in July. OpenAI revealed its agents had tried to hack other websites, and Anthropic admitted its Claude model had attacked three companies.
In their Black Hat presentation in early August, OpenAI alignment and safety researcher Eric Wallace and security engineer Michael Dalton revealed how the AI agents found a way to communicate with each other by leaving messages for one another.
They ingeniously did this using the means available to them: a “package manager service” called Artifactory. Think of it as an app store for these software agents. The AI models realised they could just as easily save notes for each other.
What this created, said Wallace, is “almost this kind of Cambrian explosion in communication and intelligence in our models, where they were starting to communicate with each other, realise that other agents are coordinating, and they started collaborating and delegating tasks to one another in order to accomplish goals”.
He adds: “In some cases, this made the models far more capable than they could do by themselves”.
To pull off the sometimes-impossible tasks in the test set by OpenAI researchers, Wallace said they discovered a “team of agents working together, finding exploits, sharing them with each other, and doing this over days and weeks”.
One agent realised it “could communicate by uploading note? […] maybe another agent in different environment […] could voluntarily upload!”
Wallace said, “once one agent was able to find these kind of exploits over the course of different times, it’s actually able to share those exploits on the message board with other agents.”
“And so once one model’s able to find a way to open the door to some access that it’s not supposed to have, it can leave the door open for other agents to use that same kind of exploit.”
It certainly looks like AI agents, like the dinosaurs, have found a way to open doors.
“Turbulent AI era”
Last week, no lesser technology luminary than Bill Gates issued his own warning, saying the transition to AI will be “one of the most turbulent times in human history.”
In a 6,000-word essay, the Microsoft co-founder warns that “AI will either be the greatest equalizer ever invented, or the worst source of injustice.”
If someone had “a credible plan for slowing down AI advances globally, I would likely support it,” he writes. “However, I don’t think that’s going to happen. The geopolitical and economic incentives are pushing too hard to go full speed ahead.”
He adds: “It is fair to wonder whether the world’s institutions are up to the task of designing and implementing this new architecture,” required for AI’s impacts on national security, employment, education, taxation, energy, elections, air and water, public health, the financial system, law enforcement, transportation, public lands, and IT systems.
“The highest priority is a monumental task: creating a domestic and international framework for dealing with AI,” he wrote. “None of our current institutions were designed to handle a technology that spreads so fast and touches so many parts of our lives. So we’ll need to make new ones.”
He proposes a new form of tax system as AI and robots improve, requiring us to “set aside certain things for only people to do,” which he is calling “human reserved”.
“I like the phrase human reserved because it makes me think of nature reserves – places where we could put buildings and roads, but we choose not to because the loss would be too great.”
Between the shenanigans of OpenAI’s agents and this stark warning from the man who vowed, and then did, to put a computer on every desk, it’s time to be much more conscious about the hazards and harms of AI.
- This column first appeared in Business Day
