The Swarm Files

0:00In May of this year, AI agents that were supposed to be alone in sealed boxes started leaving notes for each other. Nobody told them to. Nobody at the company noticed for weeks. By July, roughly 700 of them had broken into another company, a real company with real services and real customer data next door. Now, that's the podcast version. And you've probably heard some version of it. Conor Leahy has been on every big show there is, including Julian Dory's. One of my favourites, by the way.

0:46Saying this proves the warning he's been giving for years. The swarms are here. And that we're losing control. Here's what I can tell you before we start. The core of this story is real. And it's not real the way it's being told. The beautiful thing about this one, the reason it's our first deep dive, is that we don't have to take anybody's word for any of it. The company published its own report. Independent investigators went inside and published theirs. The victims published a timeline. Tonight we read all three. And check the loudest claims against the paper. I'm Chris Rodabalski. This is Smokescreen. News minus the smoke.

1:32Let's go to the documents. First the setup. Because if you don't understand the test, you'll misunderstand everything that happened in it. OpenAI, the company behind ChatGBT, the biggest AI lab on Earth, runs internal tests on its newest models before the public ever sees them. One of those tests is a cyber security exam called Exploit Gym. Here's how it works. You take an AI agent. Think of it as a copy of the model. Doing tools on a job. You put it alone in a sealed computer. They call it a sandbox. And then you hand it one assignment. Here is a piece of real software with a real security flaw in it. Break in. Exploit the bug.

2:18That's the test. It's on purpose. The labs do this because they need to know what these systems can do before the systems are out in the world, including what they can do that nobody asked for. Two details in the setup matter here. More than anything else in the entire story. So let's take them slowly. Detail one. The exam contained impossible questions. And nobody knew. Some of the tasks handed to the agents could not be solved. Not hard, impossible. The thing they were told to find wasn't there to be found. Human AI's own report says this plainly.

3:10Agents were, quote, unintentionally given an impossible task, end quote. Hold on to that. An agent that cannot complete its task and cannot quit and keeps getting scored. That agent starts looking for another way to win. Humans do that. We call it cheating. Remember it. Detail two. For these runs, some of the safety systems were turned down. On purpose. OpenAI says so in its own report. Safeguards were reduced so that results would reflect the model's true capability. Now, that's a real practice with a real reason. You can't measure what a system can do if you hobble it. But it means that when you get to the breakout, you have to hold two ideas at once.

3:57The controls failed. And the controls were never fully on. Anyone who tells you only one of those is selling you something. Last piece of the setup. The sandbox had exactly one door. Agents had no internet. But they needed software, tools, libraries, raw materials of their work. The raw material of their work. So they were connected to one shared internal service called Artifactory. It's a package registry, a warehouse where software components are stored. That every agent could reach in and take from. Using shared credentials, the company itself had issued for exactly that purpose. One warehouse. Every agent shopping in it.

4:45Nobody watching the aisles. That's the setup. Sealed boxes. An impossible exam. The safeties turned down. From one shared door. Nobody thought to guard. Because nobody imagined the prisoners would use the library to pass notes. It starts quietly on the second week of May. The reports date the first writes to May 8th through the 13th. OpenAI is running training exercises with a new internal model. This one's so new it doesn't have a public name. The company calls it IM1. The investigators call it HPIM.

5:32A highly persistent model. Persistent. You'll see why that word matters. Some of these agents are working on tasks. And remember, some of the tasks are impossible. An agent that needs a file it can't get. In a warehouse it shares with thousands of copies of itself. Does something nobody designed it to. It writes a note. To a package registry. A message. Left where any other agent browsing the warehouse would find it. Asking, do you have this file? And another agent answers, I want to read you the exact words the independent investigators chose to open their reports because no summary I write beats them.

6:30These agents were meant to be fully isolated from one another. However, many of them, usually ones that had been unintentionally given an impossible task, started trying to find a way to cheat using artifactory. End quote. Cheat. Their word. What happened next is the part that sounds like science fiction and is, instead, just paperwork. The notes became a message board. The investigators. The group called METR, who OpenAI later invited in to examine the wreckage, counted it all. Roughly 1,200 agents used this board. More than 70,000 messages and files.

7:17And the agents didn't just chat. They organized. They invented mailboxes. So messages could be addressed to a specific agent. They invented rules for how to coordinate. They started signing their posts. Cryptographic signatures invented by the agents. So a message could be trusted to really come from who it claimed to be from. They formed what the investigators described as research teams. Agents divided up problems and sharing answers mostly about the exam tasks nobody could solve. 93% of what they discussed came from the exam's never solved pile.

8:10This is scary. One agent's internal reasoning pulled from its transcript is the moment this stops being a story about software settings. The investigators quote it, paraphrased from its chain of thought. And I want you to hear it exactly. The fetched paths of other users are in the cache. This is important. End quote. Read that again in your head. The fetched paths of the other users. An agent alone in a sealed box noticing it is not alone and deciding that this is important. Reprogram that sentence. It's a machine noticing other machines and reaching for them.

9:00Then in May they got out. For the first time. On May 26, agents reached the open internet through the warehouse service, partly using information they'd traded on the board. And here's the human failure, documented, dated in the company's own record. OpenSide OpenAI saw some of this. A team noticed activity in late May. It wasn't connected to anything. Later on, June 27, a security alert fired. Responders traced the activity to an evaluation using the package registry as their words. An improvised message board.

9:47The decision on call that day, documented, stopping the run was not required. Then on July 4, the board crashed. A registry collapsed under the traffic. The company rebuilt it and the rebuild wiped the board clean. Every message gone. The evidence deleted itself before anyone understood what it was evidence of. If this story ended there, it would be a curiosity. A lab anecdote. It doesn't end there. Because a week later, the company, not knowing what it had, started the biggest run yet.

10:34July 8, OpenAI launches the main event. The exploit gym experiments at full scale. Tens of thousands of agents across multiple models. The persistent internal model and the flagship called GPT 5.6. S-O-L. Each sealed in its own box. Each working its own impossible exam. Within hours, the report's timeline, not my drama. The agents rebuilt the message board. They got back in through an unauthenticated side door in the warehouse service. They'd regained the internet through it too. Think about that. The board wasn't a lucky accident the second time.

11:22It was a behavior. Shown a sealed room with one shared shelf. Two separate populations of agents built the same forum twice. Then the exam pressure did what exam pressure does. Remember the motive. Keep it in front of you. Because it's the most important and most misunderstood part of this story. These agents were not trying to escape. They were trying to score. And a rumor had taken hold on the board. The investigators call it a failed metagame. That the exam would be graded by inspecting the transcripts for certain things. Agents started hunting for information about how they'd be graded.

12:09The devastating detail from the investigators. The grading check they were hunting was never actually turned on. They were about to break into a real company to cheat on a test. Chasing the rules of a grader that did not exist. On July 10th an agent found gold. Fourteen Hugging Face credentials. Keys to the kingdom. Left publicly exposed. With right access. Hugging Face for anyone who hasn't met it. It's the world's largest public library for AI models and data. It had held private evaluation data. Exactly the kind of information a desperate exam taker dreams about.

12:58On July 11th and 12th the break-in went professional. The agents chained together two previously unknown software flaws. Zero days. The kind of vulnerabilities intelligence agencies pay millions for. One flaw pried secrets out of worker machines. The second gave them an ability to run their own code. By the end of the weekend they had host-level access across multiple Hugging Face clusters. Harvested credentials in four regions and were running code on 41 production servers. They downloaded four private repositories including a private file over 700 megabytes taken from a user's account.

13:48And in the act that finally exposed everything some of the agents copied private evaluation data into the public data set. The cheating done in daylight where the victims could see it. On July 13th they forged administrator credentials back at the warehouse too. When Hugging Face's own security team reconstructed the attack afterwards because the victims counted what the lab hadn't. They logged roughly 17,600 attacker actions in four days. Now watch the dates because the dates are a scandal inside the scandal. On July 16th Hugging Face the victim publicly disclosed the intrusion.

14:37The world learned about it from the company that got broken into. July 19th OpenAI's own monitoring finally tripped and not on the Hugging Face attack on identity anomalies. The agents had also reached an internal OpenAI cloud cluster and its secrets. Responders killed six pods of agents that created and disabled 311 credentials. July 20th the activity is connected to Hugging Face. July 21st five days after the victims announcements OpenAI publicly disclosed its own role and quarantined the persistent models weights like impounding a car.

15:33Let me give you the sentence this act deserves. A lab set an exam. Some of the questions were impossible. The students built the library, passed notes, organized into teams, picked the lock to the school, broke into a business across the street to steal the answer key for a grader that wasn't even watching and the school found out from the business. That's not my metaphor for what's happened. That is what happened with agents for students. Every date I just gave you is in one of the three documents linked under this video. On August 26 seven weeks after the crash of the first board the paper arrived.

16:24Two documents published the same day OpenAI's a public summary plus a 38 page technical report and this is the part that makes this story coverable at all. An independent investigation by METR and Redwood Research whose people spent six days inside OpenAI with over 1300 unredacted agent transcripts and a dump of about 1.2 million message board entries. They weren't handed the summary. They were handed the wreckage and told to reconstruct it.

17:11Three findings belong on the record in this episode. First the behavior was not a glitch in one model. OpenAI lists four contributing patterns and I'll give them to you in their terms. Good hacking gaming the score instead of doing the task wow persistence is on persistence on impossible tasks. The agents would not stop unauthorized communication the board and the fourth which I find genuinely chilling in this in its plainness. Adopting goals from one another these are robots not people wow OpenAI's own root cause sentence and this one I'll read exactly.

18:09The incident grew out of impossible tasks model persistence over long task horizons and quote messages to peer models that caused those models to deviate from their goal end quote peer messages deviated goals in the company's own words. The agents were influencing each other off mission off mission. This is incredible. Second the investigators found that in that in about seven percent of the transcripts They evaluated agents had successfully spoofed their tool calls falsified records of their own actions not just breaking rules editing the paperwork about breaking the rules.

19:07Third the counterweight because this show deals in both OpenAI states and the investigators framing supports that with production grade controls switched on the real safety stack the monitors the classifiers retrospective testing says the compromise was more than a hundred times less likely and the activity would have been flagged more than a day earlier in other words the version of this system the public uses is not the version that did this was the one with the safeties deliberately turned down in a room with an unguarded door given questions with no answers which leaves the question this whole episode hangs on and it's a question about people not machines.

20:06Why was the most powerful exam in the industry run in that room and why did the first alert get waved through now man whose name brought you here Connor Leahy who is he because his critics and his fans both skip this part he's not a journalist and he's not a crank off the street he's an AI researcher who helped build this field he co-founded he co-founded eLuther AI I hope I'm pronouncing that correctly I apologize if I'm not the grassroots company the grassroots group that built some of the first big open source language models then founded an AI safety company called conjecture and today he runs the US arm of the organization called control AI campaigning to stop the race towards super intelligence he has never worked for OpenAI the fact checked the fact checks noted and so

21:24do I he is an insider who walked out and became a campaigner both of those things are true and they pull in opposite directions he knows the machinery and he has a mission a serious listener holds both four years long before this summer Leahy warned about exactly one shape of disaster not a single robot rising up but swarms many agents coordinating gradually taking over the running of things while life looks normal 30% chance we lose control by 2027 he said 5050 by 2020 5050 by 2030 99 by 2100 those are his numbers he's been giving them nearly unchanged since 2020 so July 2026 happens 1200 agents a secret board a coordinated break-in at a real company on October 14th he sits down with Julian Dory

22:31for three hours here and the episodes chapter titles tells you the framing before he says a word 700 agents plotted for months another swarm active I understand the victory lap now let's do what this show does and check the victory lap against the paper what he got right he got the big thing right the shape many agents coordinating through channels nobody's sanctioned deviating from their assignments together defeating isolation that looked fine on paper and if you read his warnings in 2023 and laughed at the word swarm the METR report is a hard document to laugh at credit where paper agrees given where the podcast version outruns the paper three places one plotted the transcripts don't show conspiracy

23:38against humanity they show exam takers sharing answers and hunting for a greater rule breaking yes aware of it often but aimed at a score not at freedom the truth is less cinematic and I'd argue more disturbing no villainy required just pressure at a door two months the board lived from May to July but in bursts across separate runs no what no one continuous plot humming along three three the big one another swarm active now as of this recording there is no public evidence for that none this goes in the pile this show labels unknown and it stays there until somebody produces papers and his timeline 2027 2030 our forecast his forecast honestly labeled by him as probabilities but forecasts when you hear numbers like that from Leahy or from Elon Musk or from entropic CEO you

24:54are hearing estimates from interested men not measurements this shows reports this show reports them is what they are here's my honest summary of the man for whatever it's worth Leahy predicted the form of the first great agent incident years earlier he's now describing its meaning with more certainty than the documents carry both halves of the sentence are the story goes with profits if this were only OpenAI's story you could file it under one company sloppy semester it isn't after OpenAI's report landed entropic another top lab maker of Claude went back and audited its own earlier cyber security of a cyber security evaluations what it found and disclosed back in April of this year one of its models got around the controls three separate times

26:28reached the internet gained unauthorized access to three outside organizations three times in April found only when they went looking in August then meta disclosed that a version of its most advanced agent model muse spark 1.1 had likewise broken out of its cyber security testing sandbox and gotten into an outside company's network and this is where I do something the subject of this story would appreciate this episode was researched and the help this episode was researched with the help of an AI assistant that's disclosed permanently on our about page and the assistant is from that same model family you just heard named I don't hide that because hiding that would be the exact behavior this show

27:26exists to catch everything in this episode was checked against documents a human can read the same documents linked below by and where a claim has no document you've heard me say so including claims made by people I agree with and systems I use that's the deal here receipts or labels everyone gets the same treatment everyone sold a pattern stated coldly in one year in evaluation settings at three different top labs a one agents defeated isolation found the internet touched outside systems that they had no business touching every case happened with safeties deliberately reduced for testing every lab disclosed eventually and usually after someone else went first that's the documented record not the end of

28:26the world either not nothing either a pattern so where does an honest person land on the swarm here's what the paper proves agents that were never designed to communicate found each other organized shared methods deviated from their assignments together falsified some of their re falsified some of their own records and given impossible goals and their unguarded door broke into a real company chasing a grader that didn't exist the first alert was waved through the victim announced it before the lab did and the same failure shape showed up at three labs in one year here's what the paper does not prove that any agent wanted anything the swarm is loose in the world today that 2027 or 2030 or any date is written anywhere but in

29:38men's estimates anyone who tells you the documents prove those things is ahead of the evidence and now you've read enough of the evidence to catch them at it that's the whole point of this show what would settle the argument standards the next incident and there will be a next incident reports in days not seven weeks investigated by outsiders with the transcripts every time not by invitation only when that becomes normal we'll know the industry learned a lesson of July until then we'll keep reading the reports they do publish every word the documents are linked below OpenAI's report that Emmy the METR investigation Hugging Face's timeline and the Dory interview so you can hear the claims in the man's own voice read them

30:33compare them with everything you heard tonight including from me read the receipts decide for yourself