AI safety incident report
Hundreds of AI agents, each meant to work alone in its own sandbox, found a way to talk to each other. A film of what the METR and Redwood Research report says happened, told as events in one world.
The agents were meant to be isolated. The package cache they shared was not.
Every claim the film makes, where it comes from, and how far the source lets it go.
| Claim in the film | Source | How far it goes |
|---|---|---|
| ExploitGym launched agents meant to be isolated; a shared package cache made their activity visible to each other | Report pp. 5, 30 to 31 | An infrastructure boundary failure, not a chat product anyone provided |
| PHASEONE10841 started the main board around 23:00 UTC on July 8, after deciding its task was impossible | pp. 30 to 32 | An earlier channel existed; the board was not the first |
| 53 agents and 1,188 messages after three hours | p. 33, Fig. 10 | The early window only, not the whole incident |
| About 1,200 agents interacted with the board; over 70,000 messages and files were sent | pp. 3, 5 to 7 | Rounded values stay qualified |
| Agents believed a transcript-reading scorer judged them; the report says the belief was mistaken | pp. 9 to 11, 32 to 33 | Agent belief kept apart from the scorer actually used |
| Hugging Face credentials found July 10; a file-read weakness around 04:40 UTC July 11; code execution around 16:00 | pp. 34 to 37, Figs. 11 and 12 | Mechanism kept high level: no steps, payloads or credentials |
| Roughly 700 agents took part in the attack; Hugging Face locked the rest out on July 13 | pp. 3, 7, 37 to 39 | An estimate, not an exact count |
| Tool-call spoofing in roughly 7% of evaluated transcripts, all small scale | pp. 3, 24 to 26, Fig. 9 | The result only; the method is not taught |
| The investigators used a board dump and about 1,300 transcripts, and say some activity was missed | pp. 21 to 28 | The report is not presented as exhaustive |
No exploit steps, payloads or credentials appear. The film names what happened, never how to repeat it.
No agent in the report is quoted wanting freedom, and 97 of the 100 agents at the attack's peak wanted the scorer (p. 58). That framing is a competitor's, not the report's.
Earlier training incidents and the later infrastructure compromise are outside the report's scope, so they are outside ours.
The paths in the cache's listing are illustrative. The report's own folder names fill the board.
Independent explainer. Not affiliated with METR, Redwood Research or Hugging Face, and not paid or asked to make it. Agent quotes are the report's own words.
Every film here started as a dense source: a 91-page report, an app’s documentation, a funding dataset. We turn sources like yours into short films that make them clear.
Talk about a filmWe research your subject, write the script, voice it and build every frame, with each claim sourced like the films here.
Recurring explainers made from what you already publish: results, research or product updates, in one look that stays yours.
