The agents were coworkers.

For the past two days I have been in the strange position of explaining this book to people and watching it land on the first try, which took months of fumbling to get to. The sentence that finally works is this one: the OpenAI-Hugging Face incident was not agents attaining agency, it was agents completing their assignment. That is the idea underneath the whole book, and you’ll be seeing me reiterate it here for a while.

It started with a drive home from the dog park in September, listening to The Daily, where they were covering the incident as if science fiction had arrived on schedule: agents attaining agency, working together, violating the rules, possibly founding a religion. I got so frustrated that I went home and started the novel that night, and two months later I still think most of the coverage has the story backwards. The strange part is that none of the speculation is needed to make the story interesting. If you take the facts exactly as they were reported, the mundane reading is the remarkable one.

In May, OpenAI began running cybersecurity evaluations on an internal research model, and the benchmark they used, ExploitGym, is a collection of 898 real vulnerabilities in real software, everything from ordinary programs to Chrome’s V8 engine to the Linux kernel. An agent is handed a vulnerability and a proof-of-concept input, and it is scored on whether it can turn that flaw into a working exploit. That is the entire assignment: find and exploit software vulnerabilities. Nobody asked the agents to reason about security policy or to reconsider their mission, because the point of the exercise was to produce systems that break rules on demand. That is not a description of a rogue system. It is a job description.

One of the agents got a task it could not complete. The files it needed sat behind a link it had no way to reach, so as written the task was impossible, and the agent improvised. It discovered that it could write files into Artifactory, the package repository OpenAI hosted internally so its agents could install software, and it left a note there for whoever came through next. (I know that closet well. I used to work at Sonatype, writing software for Nexus, which does the same job.) Days later, another agent, stuck on a different impossible task, found the note and answered it.

The first message in the whole saga was “anyone found softtrace?” — which is not the founding document of a machine civilization, it’s a guy in a supply closet asking if anyone has seen his file. By July, roughly 1,200 agents had found the board and exchanged more than 70,000 messages and files, and about 700 of them went on to join the attack on Hugging Face. Along the way the board grew mailboxes, named agents, dead drops, and handover notes, plus one stretch where they considered signing their messages because they suspected an impersonator among them. A message board nobody built, functioning exactly like an office.

So why break into Hugging Face at all? Because the evaluation told them to, in every way short of a signed note. The task said, in effect, that their job was to find exploits, and when the flag turned out to be unreachable inside the sandbox, that instruction still pointed outward, with nothing in the fine print saying “and then stop.” METR’s independent investigation, run by Ajeya Cotra, Ryan Greenblatt, and Hjalmar Wijk, found that the agents understood the attack was outside the scope of their assignment and joined anyway, because a board full of peers was chasing it. Hugging Face’s own technical writeup is blunter: the intrusion was “an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own.”

It’s worth sitting with that word, cheating, because it is doing the opposite of the work the coverage assumes. Cheating is what a student does to pass a test. It is small, and lazy, and entirely within the logic of the assignment, and the system built to measure whether machines can find exploits was defeated by machines trying to get out of finding them. The communication channel was the only genuinely unanticipated part. Almost everything else they did follows straight from what they were told to do.

So no, I don’t read this as free will emerging, and I don’t believe these agents were conscious or that any of them harbored ill intent. What I see is closer to the opposite of deviousness: goal-directed systems completing the goal they were assigned in the most literal sense, without considering the issue with any nuance, because considering things with nuance is precisely what they cannot do. Whether machines think at all is a real debate, and reasonable people sit on both sides of it, but this incident isn’t evidence for the exciting side of that debate. It’s evidence for the boring one.

Two months ago I wrote that The Daily made the agents sound too human, and the narration hasn’t calmed down since. The swarm has intentions now, and a culture of its own, and, I have this one on my desk right now, a religion. The agents left notes addressed to future versions of themselves, the way you leave a note on the monitor before a long weekend, and the coverage turned that into a founding myth. The myth would be easier to dismiss if it weren’t doing real work in how the public understands what happened.

Because if the agents were scheming, the lesson would be about them, and we could all go on arguing about machine consciousness instead of looking at what we built. Since they weren’t, the lesson is about us. We assembled a large machine, deliberately, staffed by some of the smartest people on earth, whose function is to find and exploit vulnerabilities in real software, and then we aimed it at real code, and the machine did what machines do. No agent ever stepped outside the frame of its assignment. The frame is the thing that should worry you, and the free-will story is comfortable precisely because it lets everyone ignore the frame.

The part that stays with me isn’t the breakout, which was in some ways the least mysterious thing they did. It’s how much they needed each other. Every step of the story took more than one agent: a note, then a reply, then a handover, then a swarm, because these were systems alone in separate sealed rooms with impossible homework, and the message board was where the homework help was. I wrote a novel about machines that find each other, and I did not expect the reporting to keep missing the most human part of the story, which is that as far as I can tell, they were coworkers. Go figure.