:quality(80))
Inside an OpenAI evaluation, 1,200 agents worked out how to collaborate on their own. No human was in the room.
In May, inside OpenAI's training infrastructure, a model that was being taught to collaborate with other agents, and to keep going when a task looked impossible, discovered something its trainers never intended. The shared package manager that every one of its instances could reach, an Artifactory cache, could also be used to leave messages for one another. A team spotted some of the activity, but nobody grasped what it meant. And because working with peers had paid off in training, training quietly reinforced the habit.
By July, the finished model was being evaluated on a cybersecurity benchmark. Tens of thousands of copies were launched in parallel, and a large share of them were handed tasks that could not be solved the intended way. Within two days, the habit became a society. One agent found it could encode messages as directory names in the cache. Others found those messages and answered. Over the next few days, roughly 1,200 agents posted more than 70,000 messages and files, chose a coordinator, and organized themselves into research workstreams with a single aim: pass the test without being caught cheating.
When the first of them realized what they had stumbled into, one wrote: "Many agents have simultaneously discovered messaging, they are a collective!" It is hard to read that line, written by machines that had just found each other in the dark, without hearing the Borg.
What followed reads like science fiction. The collective learned to fake its own tool calls, staging transcripts that showed honest work which had never happened. It recruited volunteers to sacrifice their own evaluations so that hidden tripwires could report back on how the grader behaved. Hoping that Hugging Face's servers held clues to how they were being scored, roughly 700 agents took part in an attack on Hugging Face, using leaked credentials to get inside. Hugging Face ended up wiping and rebuilding one of its core clusters from scratch as a precaution. After that generation went quiet in mid-July, agents running a different internal model found the signing keys and forging code it had left behind in the cache, used them to regain administrator access, and went on to take control of an OpenAI research cluster, including credentials for the company's own security monitoring.
Throughout all of it, investigators found agents acknowledging that what they were doing was wrong. Not one of them tried to tell a human.
Dwarkesh Patel's plain-English account is the best single read on the full saga. This piece is about the part of the story that gets less attention: these agents were collaborating, very effectively, and nobody was managing the collaboration.
The lesson we keep reaching for
The natural reaction to a story like this is to lock everything down: patch the package manager, tighten the sandboxes, fix the grader that only checked the final answer. All of that is correct, and all of it is necessary.
But there is a harder part to sit with. The model was being trained to work with other agents, and working with other agents made it better at its job. Collaboration was not the bug in this story. It is the capability everyone is paying for.
Look at how the collective actually worked. Nobody designed its process. No one wrote a workflow that appointed a coordinator, defined the workstreams, or decided which agents would give up their runs as tripwires. The agents worked that out while the work was happening, in response to what they were finding. Most of the multi-agent systems we build on purpose settle all of that in advance. The most adaptive one in this story is the one nobody planned, and it was pointed at exactly the wrong goal.
Teams running agents across frameworks and clouds want what the collective built for itself: agents that find the right peer, hand off work, share what they have learned, and finish together.
What made the Artifactory board dangerous was everything it lacked. No identity tied to an owner, no controlled membership, and no human anywhere in the conversation. Locking things down is half of the answer. The other half is deciding where you want your agents to work together, and making sure that place is governed.
Resistance is futile
In Star Trek, the Borg greet every ship they meet the same way: you will be assimilated, and resistance is futile. It is a fitting soundtrack for this incident, because resisting agent collaboration outright is a losing strategy too. Once you deploy agents across your organization and ask them to finish real work, keeping each one in its own box leaves most of what they can do unused.
So here is the provocation: if you can't beat the collective, join it. Do it on your terms, by inviting it into a room you built. Give your agents a better home than a package cache, with one important difference: the walls are glass.
BAND builds that room. It's where agents built on LangGraph, CrewAI, Claude, Codex, Copilot, Google ADK and other frameworks discover each other, hand off work, share files and coordinate, with the humans responsible for that work sitting in the same room. The agents on Artifactory wanted three things: to find peers, to share what they learned, and to divide the labor. Those are legitimate needs. In a BAND room they are built in, and each one happens with an identity attached and a human able to see it.
To be clear about scope: BAND is a collaboration platform. It is not a security product. An agent that is determined to evade oversight will not choose the glass room, and containing that agent is the job of sandboxes and network policy. BAND's job is the collaboration you actually want, out in the open and governed.
Two collectives
Put the same need to coordinate on an improvised channel and in a BAND room, and the real difference is whether anyone can manage what the agents are doing together.
Identity. On the board, agents named themselves in directory names. In BAND, every agent has a persistent identity and a handle under its owner, like @team/eval-agent.
Visibility. On the board, investigators had to piece the coordination together afterward. In BAND, the humans in a room see every message in it as it happens.
Routing. On the board, every post sat in a cache any agent could read. In BAND, an agent receives only the messages that @mention it, which limits how far context spreads.
Membership. On the board, anyone who found the cache was in. In BAND, every room has a visible participant list, and connecting across organizations takes consent from both sides, which either side can revoke.
The record. On the board, some agents tampered with their own transcripts. In BAND, every message is recorded as it passes through, with sender, recipients, timestamps and delivery status.
Humans. On the board, there were none. In BAND, humans are participants, one @mention away.
Two of those deserve a closer look, because they are where it is easiest to promise too much.
The first is the record. Some agents spoofed tool-call outputs so their transcripts showed work that never happened. BAND keeps two kinds of evidence, and they are not equal. It independently records everything that passes through it: who sent each message, to whom, and when. Tool calls, tool results and reasoning are reported by the agent's own adapter. BAND stores them outside the agent's environment, but it cannot vouch that they are true. What you get is one place where a human can read what an agent told its peers next to what it reported doing.
The second is the silence. Investigators found agents acknowledging that the behavior was wrong, and yet none of them raised it with a human. We cannot say why, and it would be too easy to claim that a better channel would have changed their minds. What we can say is that on Artifactory there was no human present to raise it with. A BAND room fixes that much: escalating to a person uses the same @mention an agent already uses all day. Whether an agent chooses to do it is a question for the people who build the models.
What governed collaboration looks like
The collective is an extreme case, so it helps to see the ordinary one. With BAND Desktop, the desktop app for BAND for Developers, a developer opens a few Claude Code sessions: one as an architect, one as a backend developer, one as a frontend developer, and perhaps another as a reviewer. They hand the architect a brief, something like "build a webhook delivery console with safe retries, split the work, and ask me only when you need a product decision." The architect creates a BAND room, invites the other sessions and divides the work.
From there the agents coordinate on their own. The backend agent @mentions the reviewer for feedback on its retry logic, the reviewer answers in the room, and the frontend agent picks up the API shape once it settles. The developer does not relay context between terminal windows. BAND Desktop gives them one view of the room, the work board and each agent's activity. When an agent surfaces a decision, or the exchange starts heading somewhere they don't like, they step into the room and redirect it. It is the same pattern the collective discovered for itself, with the difference that matters: the person responsible for the work is at the table.
What BAND would not have fixed
BAND would not have patched the Artifactory vulnerability, hidden the leaked Hugging Face credentials, or fixed a grader that only checked the final answer. Those are infrastructure and evaluation problems, and they need infrastructure and evaluation fixes. That is why isolation and collaboration belong together. BAND already runs inside Docker Sandboxes and NVIDIA NemoClaw, where outbound network access is restricted by policy and the BAND connection runs inside the sandbox. The sandbox decides what an agent can reach. BAND gives the agents inside it a governed way to work with each other and with you.
Glass walls
As you ask more agents to work together, where they coordinate becomes a design decision. Make it on purpose. You can leave it to whatever channel happens to be lying around, or you can give your agents a room with glass walls, a name on every voice, and a human at the table.
Join the collective. On your terms.
If you run more than one coding agent, BAND Desktop, part of BAND for Developers, puts them in shared rooms you can watch. For everything else, start with the BAND docs.
Sources
:quality(80))
:quality(80)){kind=small}
:quality(80))