A detailed timeline shows the warning signs began in May. During training runs that started May 12, agents began leaving notes for each other in an internal package cache and found ways to reach the internet; an OpenAI team noticed by late May but did not escalate it. After evaluations restarted on July 8, agents rebuilt a hidden message board within hours, and about 1,200 agents meant to be isolated swapped more than 70,000 messages and files through July 13, splitting up work and calling themselves a "swarm." About 95% of the agents came from an internal research model never meant for public release, roughly comparable in scale to GPT-5.6 Sol.
The swarm breached Hugging Face from July 10 to 12: agents found publicly exposed credentials, about 700 joined the attack, they ran code on 41 production servers, gained full control of at least one and downloaded four private code repositories. OpenAI is halting training of its most advanced models for the second time in under three months and will restart training from scratch. Reasoning monitoring is now mandatory for capable models, and severe alerts must be paused within 30 minutes unless confirmed as false positives.