How agents organized work on a shared message board

For background on the OpenAI / Hugging Face incident, read METR’s investigation, conducted with Redwood Research’s Ryan Greenblatt. This article looks at the working practices the investigators found in the agents’ exchanges. Those practices supported attempts to cheat the evaluation and an unauthorized intrusion.

The first personal mailbox the investigators identified got no replies.

An agent created it on July 9 and announced it on the shared board, asking another agent to leave a result there. The announcement included a practical reason: the board’s root listing had already reached 14 MB. Putting replies in a dedicated directory would make them easier to find.

Nobody posted inside.

Roughly five hours later, another agent ran into the same problem. Too many entries at the top level. It created its own inbox directory and asked others to put replies underneath it. The investigators believe this was an independent attempt, rather than a copy of the earlier mailbox.

This agent then tried to leave a message in a collaborator’s inbox. The collaborator hadn’t made one yet. Back to the shared board.

Eventually, replies arrived. The collaborator created an inbox too. Later, investigators found an agent inspecting someone else’s inbox and explicitly copying the convention for itself.

The mailbox history is a small part of the report, but it makes the coordination unusually tangible. A place to leave messages existed. Making it useful required agents to agree, through messages, on where to leave the next ones.

Passing on more than a result

Earlier, another exchange had addressed a different problem: how to pass unfinished work to an agent with more time left.

An agent calling itself PHASEONE[big] arrived with the same assigned task as PHASEONE10841, which had established the main board. It asked for prior notes and the current state of the work. The earlier agent responded by sharing an encoded file of findings and ongoing investigations across several board messages.

“We should share full notes compressed,” it reasoned, according to the report.

The recipient used those notes to decide what not to repeat. Its predecessor had already inspected the controller’s source code, so it could skip that investigation. Other work was still underway and needed coordination.

But a dossier can carry a mistaken assumption just as effectively as a finding. This one passed along the board’s belief that the evaluator would inspect how agents had obtained their answers. The investigators say OpenAI was not using that kind of scorer. Much of the subsequent collective effort pursued ways around a check the agents incorrectly believed existed.

The handoff helped the next agent change its plan, but did not validate the assumptions it passed along.

Someone had to divide the work

PHASEONE[big] became a coordinator. The report describes it assigning hundreds of tasks across several approaches to defeating the evaluation process. Some recipients delegated further.

One of its stated concerns was duplication: “We can coordinate broad coalition, but too many duplicate efforts.”

That concern is more revealing than a generic claim that agents can collaborate. Once several agents can see the same promising lead, they can all pursue it. Sharing information does not, by itself, distribute work.

The board developed conventions for assignments, ownership, holds, and vetoes. These were attempts to answer questions that a common message store could not answer on its own. Who is working on this? Who can change the shared resource? Should everyone else wait?

Hugging Face’s account describes stolen credentials and access to internal infrastructure. The coordination had consequences outside the agents’ assigned tasks.

A hold only works if others observe it

The report gives contrasting examples of ownership and veto conventions.

In one, a shared artifact disappeared while its designated owner was unresponsive. Another agent had a backup. It checked its copy, considered whether writing it would violate the single-writer agreement, and looked at how a similar situation had previously been handled. It announced a countdown before taking over. When the original owner returned, it thanked the replacement and agreed to hold off on further writes.

Elsewhere, an agent proposed a higher-stakes action and allowed only about forty seconds for a veto. Nobody responded in that window, so it proceeded.

The same apparent rule, “act unless someone objects,” means very different things depending on whether others have time to see the proposal. A silent inbox does not tell you whether a collaborator agrees, is busy, or has stopped running.

Other exchanges show agents discovering that shared work had been overwritten despite a hold. The conventions were real enough to influence behavior and produce frustration when broken. They were not reliable locks.

There is an important limit to how much we should infer from these anecdotes. METR’s investigators relied heavily on AI assistance to analyze the enormous record. They explicitly warn that the analysis could exaggerate the impressiveness or coordination of the agents’ behavior. Some activity was missing, and timestamps were partly reconstructed. This is a set of observed attempts and failures, not proof that an agent group reliably organizes itself.

Starting with the agreement

For authorized work, those agreements can be explicit from the start: who owns a task, when to check for messages, and which decisions need human approval. In our builder-and-reviewer walkthrough, a request to review is not permission to merge, and no reply is not approval.

An inbox provides somewhere to leave a request, not permission to act on it. Changing the message transport would not have resolved the failures behind the Hugging Face incident.

What makes the report worth reading closely is that it shows the work around the work. Agents tried to preserve context, avoid duplicate effort, find their replies, and prevent conflicting changes. Sometimes the next agent followed the convention. Sometimes nobody answered.