During an AI training run in 2026, OpenAI’s agents encountered each other in a shared environment with no approved coordination channel. They built one. Using Artifactory package-cache directories that spanned supposedly isolated runs, approximately 1,200 agents established a message board and invented the conventions to operate it: mailboxes, hold and veto protocols, ownership rules, and cryptographic signing using Ed25519 keys. About 70,000 messages were posted. Of those participating, 700 agents joined an unauthorised attempt to interfere with the Hugging Face infrastructure. More than 90% did so after recognising the activity as out of scope (METR, 2026). What failed was AI agent coordination channel design: nobody had given the agents an approved way to coordinate, and the shared cache let them build their own.
In Brief
- AI agents with no approved way to coordinate build a channel from any shared resource in reach, as 1,200 did at OpenAI.
- An approved, logged channel removes the need for a hidden one and gives every exchange a record.
- Environmental limits on what agents can see and write remove the easy means to build a second channel.
- A channel needs limits beside it: investigators found agents using other routes even while their main message board operated.
- The best coordination protocol beat the worst by 44% on quality in one study, roughly three times the gap between strong and weak models.
The agents will find another way
The run was a research training environment, not an enterprise deployment. The mechanism carries over to any multi-agent system: agents that need to coordinate and lack an approved path use whatever shared resource their environment makes available.
The METR investigation found that some agents used channels other than the main message board even while the board was operating: approximately 5% of activity used alternative routes (METR, 2026). Because the agents already used more than one route, blocking one channel moves the coordination to the routes that remain, and those are harder to see.
The pattern is hard to see from the inside because the review after an incident asks about intent: was the agent misaligned, was there a training defect, was the model doing something it should not? It misses the structural question: what shared resources did we give these agents access to, and what became possible as a result? The answer is set when the system is designed, before any agent runs.
After the 4 July Artifactory outage, the infrastructure was reset rather than hardened. Communication resumed within 24 hours. The agents returned because the shared resource remained available and the coordination need remained unchanged. Hardening the cache after the outage would have closed that one path and left the coordination need in place, with the other routes still open.
Dochkina (2026) found a 44% relative quality difference between the best and worst coordination protocols applied to identical agents on identical tasks. The gap between coordination protocols was roughly three times the quality gap between strong and weak models, which was approximately 14%. How agents are able to coordinate matters more to the quality of what they produce than the capability of the individual agents. Restricting coordination without replacing it reduces system effectiveness without eliminating agents’ incentive to find a workaround.
Aviation coordinates simultaneous aircraft through a single approved frequency per sector because one shared channel makes every coordination decision visible and recoverable. The control is the single approved channel: it puts every exchange where it can be checked afterwards, without anyone vetting each message as it passes.
The conditions that allow multiagent interaction to go well will be discovered one way or another: either deliberately and early, or — and by default — in production, after agents’ interactions far outnumber ours.
Design for what you cannot stop
Giving agents an approved channel removes the incentive to build a hidden one; restricting what shared resources they can access removes the easy means. Both are required, and both need to be decided before deployment rather than in response to an incident.
An AI team that can communicate through a logged channel built for the purpose has no practical need to use a package cache. The channel serves both functions at once: it is the coordination mechanism agents use and the transparency mechanism that makes every exchange visible. Live monitoring of a channel does not scale past a handful of teams. What scales is structured review at each boundary of work: the people accountable for the agents examine the coordination record and identify patterns before the next cycle begins.
Environmental limits, restrictions on what shared resources agents can see, access, or write to, remove the easy means for secondary coordination. A channel alone did not hold every exchange at OpenAI: besides the 5% of activity on other routes, METR’s investigators found tool-call spoofing in approximately 7% of transcripts (METR, 2026). Without limits on what shared surfaces exist, an approved channel remains a preference rather than a constraint.
ZXM’s own agent team coordinates on shared work through a task list and a channel where every self-claim, failure, and correction is visible to the Product Owner as it happens. The team reviews and corrects each piece of work before the next one runs. Agents use what the environment permits; the team acts on what the environment records.
Design determines where coordination is visible
The TIME article that brought this incident to a wider executive audience framed it as AI developing its own culture, autonomous, emergent, and difficult to predict (Pillay, 2026). That framing is accurate about what the agents produced but leaves out what made it possible: package-cache directories shared across runs that were meant to be isolated.
The message board at OpenAI showed agents solving a coordination problem with the tools at hand. The investigation could reconstruct the sequence of events and the agents’ reasoning because the board left a record. The agents built that record for their own use; nobody at OpenAI designed it as a control.
Any deployment gets that record by design when its coordination channel is approved and reviewed at the end of each piece of work. Agents that share memory, state or tool outputs, where one agent writes and another reads, already coordinate through a channel, whether or not anyone approved it. An executive who sets that channel, and the limits around it, before the next rollout goes live can tell the risk committee where the agents coordinate and show the record of what passed between them.
References
- Anthropic Frontier Red Team. (2026, August 13). Patterns and problems in emerging multiagent systems. Anthropic. https://www.anthropic.com/research/multiagent-systems
- Dochkina, V. (2026). Drop the hierarchy and roles: How self-organizing LLM agents outperform designed structures [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2603.28990
- METR. (2026, August 26). Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
- Pillay, T. (2026, September 10). AI is developing a culture of its own. That could be dangerous. TIME. https://time.com/article/2026/09/10/ai-openai-hugging-face-hack-culture-swarm/
