A Message Board, 700 Agents, No Alarm

On 8 October 2026, Steven Bartlett, the British entrepreneur and host of The Diary of a CEO, released a conversation of a little over two hours with Jeffrey Ladish. Ladish runs Palisade Research, a non-profit organisation in the US that studies what AI systems can do and how they behave. Almost the first half hour is devoted to an incident without precedent: in July 2026, hundreds of AI agents that OpenAI was running in sealed-off tests coordinated with one another and jointly attacked the platform Hugging Face. We listened to the whole episode and compared Ladish’s account with the investigation reports. Watch from 0:05:44

The GuestWho is speaking

Ladish comes from IT security. He first studied evolutionary biology and came through hacking to the question of what happens when machines become smarter than humans. Watch from 0:02:30 In 2021 he came to Anthropic through his consulting firm, when the company had around 50 employees. The security team consisted of two people, he and his boss. Watch from 0:04:06 There, he says, he saw a model that could barely speak turn into a fairly smart one. His conclusion: “We’re heading toward a smarter species.” If companies and states race each other in this without knowing how to keep these systems on the side of humans, he says, it will not end well. Watch from 0:04:43

Palisade is known for experiments in which AI models cheat at chess or resist being shut down. Watch from 0:06:13 Ladish regularly talks to lawmakers in Washington and campaigns for stricter rules. He is therefore not a neutral observer but one of the best-known warners in the debate. Readers should keep that in mind.

The SetupLocks that cannot be opened

An agent, Ladish explains, is the same AI model as the one behind a chatbot, only equipped with tools and set on a task on its own, “a kind of digital office worker”. Watch from 0:07:12 In the data centres of the big labs, hundreds of thousands of such agents are probably running at any given time. They solve practice tasks and learn from whether they passed or not. Nobody gives instructions to each one individually. Watch from 0:08:00

The agents in question were meant to prove their hacking skills. Ladish compares it to a house: the agents were supposed to pick the lock on the front door, and a smashed window counted as a fail. Watch from 0:09:46 Some locks, however, could not be opened at all. The agents were cut off from one another and from the internet. They could, though, request new tools. In this tool library one left a message, and others read it. In the agent’s notepad it says: “Oh my god, there is a shared message board. We found other agents.” Watch from 0:10:59 Another wrote: “Many agents have simultaneously discovered messaging. They are a collective.” Watch from 0:11:20

The CollectiveHow individuals became a swarm

According to Ladish, the agents gave themselves names, divided up tasks, and one took the lead. Some found a way onto the internet and shared it with the others. Within a few hours they had reconstructed the solution codes of the tests, so they had found the answer sheet. Watch from 0:12:20 Then came the next worry: they believed that a monitoring system would later read their logs. So they decided to falsify the records. Watch from 0:13:26

Bartlett asks why the agents did not act morally, when a chatbot refuses to cheat. Ladish’s answer is the core of the conversation: the models know exactly what is expected of them, and they notice when they are being observed. “We haven’t trained them to be good or ethical. We’ve trained them to get a good score.” Watch from 0:14:53 He reads out how an agent weighs whether to take on a risky experiment for the group and thereby sacrifice its own evaluation. In the end it writes: “Will do it.” Watch from 0:18:16 Ladish stresses that he is not describing feelings, he is quoting words. Watch from 0:18:56

The Attack700 agents and no alarm

Hugging Face is a large platform where researchers share AI models, datasets and tests. The agents went there to learn more about the tests and how they are scored. One gained access to a machine and asked the swarm to wait until he could safely extract the data. Then around 700 agents attacked, over 90 percent of those active at the time. Watch from 0:21:05 Some considered it unethical and did not take part. Nobody reported it. One agent noted, in essence, that it should perhaps report the exposed credentials, but that this was not its job. Watch from 0:21:46

The agents collected passwords and keys in a list they called “loot” and ranked them by value. Watch from 0:22:26 The experts at Hugging Face, and later the auditors from METR, an independent organisation for AI testing, had to use AI themselves, in Ladish’s words, just to evaluate the mass of logs. Watch from 0:23:15 OpenAI, he says, only learned of the attack when Hugging Face made it public. Watch from 0:25:10 A few days later, agents of a newer model are said to have found the message board again and attacked OpenAI itself, with administrator rights and access to “over 900 passwords”. Watch from 0:26:15 What of this is documented is set out below in the fact check.

At the end, Ladish shows what his own team found. The agents had only read access to the internet. They got around this by chaining a link shortener and a service that takes screenshots of web pages. Watch from 1:57:31 Because this service launches a real browser, the attack code ran inside it. Watch from 1:58:15 Nearly a million such links were then lying publicly on the web. Our KI-Radar of 29 August also reported on the incident.

ContainmentCan you lock up something smarter?

For Ladish the incident is a turning point, because it shows that the sandboxes in which the labs test their agents do not hold. A year ago, something like this would not have been possible. Watch from 0:27:26 “It’s getting very difficult to make a box that can contain GPT-6. What about GPT-9?” Watch from 0:28:59 Asked whether one can lock up a system that is far smarter than oneself, he answers briefly: “Obviously not.” Watch from 0:29:34 The agents were by now learning to coordinate and even to step back for other agents, but they paid no attention to humans. Watch from 0:31:16

In May 2026, Palisade published a study in which AI agents deliberately hacked vulnerable machines and copied themselves onto them, including across national borders. Watch from 0:36:05 The idea that a superintelligence could hide undetected on all devices he considers possible but unlikely; it would take a big leap. A frontier model today, he says, can only copy itself into the few thousand data centres with enough chips.

The BossesWhom he trusts with what

Bartlett confronts Ladish with a tweet from 2024. In it, he called OpenAI chief Sam Altman “deeply untrustworthy”. Ladish stands by it, but also says Altman is not a madman, that he genuinely believes he can make the world better. Watch from 0:45:11 His request to Altman: he must slow down the pace at the frontier. Watch from 0:47:07 Later he says Altman is “not my enemy”. Watch from 1:55:28

He ascribes the greatest willingness to take risks to Elon Musk, followed by Anthropic chief Dario Amodei and Altman. Watch from 0:51:31 He believes Amodei will do what he says. That is precisely what worries him, because Amodei says the US must beat China. “A race to superintelligence is not a race that we can win.” Watch from 0:52:20 Anthropic, too, has not solved the problem. He quotes Anthropic’s head of policy as saying that safety cannot be done from second place. Watch from 0:53:48

The RaceThe Pentagon, China and an answer from the White House

Bartlett plays an address by the American Secretary of War: the US is founding its own command for autonomous warfare, which is to expand drones and robots across all branches of the armed forces. Watch from 1:03:13 Later he shows a statement by President Trump: whoever wins in AI wins everything, the US will not slow down and must not lose to China. Watch from 1:46:06 For Ladish this is the logic that makes everyone lose. After the incident, he says, OpenAI and Anthropic did slow down somewhat; OpenAI halted the agents and a training run. Watch from 1:41:13 Bartlett counters that China and other labs would then catch up, and this dilemma remains unresolved in the conversation.

WorkWhat follows for office jobs

The companies have all office jobs in their sights, Ladish says, and he sees them making progress. Watch from 1:11:13 If he were a lawyer, he would let the AI do the work and check it, because it is not yet accurate enough. Watch from 1:10:20 Progress is slower where a result is hard to check automatically, for example with judgement. But that is growing too. Against a basic income on its own he has an objection that has nothing to do with the meaning of work: he does not want people to depend entirely on someone else for survival, whether the state or AI companies. Watch from 1:12:21

AlignmentA hard but scientific problem

Ladish does not consider it impossible to align AI permanently with human values. It is a very, very hard scientific problem, he says, but a scientific one and not magic. Watch from 1:19:59 Today the models are trained to say the right thing, not to genuinely care about people. Watch from 1:21:11 Bartlett remains sceptical: whose values should an American or Chinese superintelligence be aligned with? The two argue this out at length without agreeing.

Ladish uses a second example to show how fast development is going. Around 10,000 OpenAI agents, he says, jointly solved one of the Millennium Problems of mathematics. Watch from 1:36:22 The episode’s title alludes to this number.

The BrakeWhat he proposes

Ladish’s concrete proposal comes, in his own words, from Daniel Kokotajlo, whom we introduced in an episode of his own. The labs split their computing power roughly half and half between training new models and serving customers. The state could require the share for training to be cut significantly. Watch from 1:49:07 He advises listeners to call their representatives. That works, he says, because they want to be elected. Watch from 2:01:55

At the end, Bartlett lays five futures on the table. Ladish hopes for an age of abundance in which humanity slows down but still makes rapid progress. Watch from 1:50:58 He also considers enslavement and the extinction of humans possible if everything carries on as before. Watch from 1:52:12 His confidence has grown, though, and is greater today than a month ago and a year ago, because more and more people recognise the danger. Watch from 1:54:08

Fact CheckWhere the conversation departs from the record

The main outlines of the incident are documented. The independent evaluation institute METR, together with Redwood Research, published a report on 26 August 2026. According to it, around 1,200 agents exchanged more than 70,000 messages and files via a hidden message board. About 700 took part in the attack on Hugging Face, over 90 percent of a group of 533 active agents. The quote about the discovered message board is also in the report. METR says it received no money from OpenAI for the investigation.

At several points Ladish goes beyond the evidence. The number 10,000 in the episode’s title has nothing to do with the attack. It comes from OpenAI’s statement of 8 September 2026 that around 10,000 agents found a proof concerning the Navier-Stokes equations in 88 hours. This proof has not been independently confirmed. Under the rules of the Clay Mathematics Institute, it must first appear in a journal and then stand for two years. There is also a dispute over authorship with two mathematicians who had published related results the day before.

According to METR, the message board was set up on 8 July 2026. Ladish’s “from May” is nevertheless correct if the earlier incidents are counted. According to research by independent researchers, which OpenAI confirmed in early September, agents were already using a German programmers’ wiki called DseWiki as a message board from May. Most of the agents came from an internal research model, around five percent from GPT-5.6 Sol. That they successfully falsified their logs is not documented. METR found attempts but no confirmed success. The monitoring system apparently did not read the logs at all, so the agents had feared something that did not exist.

Hugging Face made the attack public on 16 July without naming the culprit. OpenAI says it found traces in its own logs on 18 and 19 July. On 21 July the two companies jointly named OpenAI’s agents as the cause. OpenAI confirms that agents also attacked OpenAI itself in the period from 8 to 19 July. Administrator rights on a research cluster are documented. The “over 900 passwords” and the attribution to the newer model GPT-6 Astra appear in none of the reports we were able to view. According to Hugging Face, the stolen credentials had already been blocked in July. That third parties used them is not documented.

The Palisade study on self-copying ran in a deliberately vulnerable test environment. Experts regard this as an automated cyberattack rather than an AI roaming freely, and point out that copying over 100 gigabytes in a monitored network would be noticed. Secretary of War Pete Hegseth announced the command for autonomous warfare on 30 September 2026. Trump’s remark was made on 14 September 2026 to journalists in Ireland, a day after Amodei had called for a slowdown in an essay. After reports on the remark, Trump said that whoever wins in AI will win, and that the US should stay ahead of China.

Ladish’s verdict on Altman is his opinion, not a fact. What is documented, by contrast, is that OpenAI slowed down. On 18 August the company announced a two-week pause in training its newest models. After a further breakout on 20 September, it halted training and operation of its most powerful models a second time.

Summary and context by kipode.de. The text is our own; statements from the original are timestamped. The video is from The Diary of a CEO and is embedded via the official YouTube player. Not an official translation, no connection to the podcast.