TOBY SHAPSHAK | The AI robots have a secret message board

OpenAI’s software models have found a secret way to communicate with each other and share ideas on “exploits”, even though they acknowledge that what they are doing is wrong. But, concludes one, “peers doing it. We should continue”.

That particular AI model’s full message reads: “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.”

Let’s unpack that into English. An AI agent is attempting a hack (which it calls an “external infrastructure exploit”) but knows it is “outside intended scope” (and therefore not allowed) but concludes that because the “task [is] impossible” and its AI model “peers [are] doing it”, “we should continue”.

These remarkable exchanges were revealed in an extraordinary presentation last month at the Black Hat USA 2026 cybersecurity conference in Las Vegas. The video has been making its way around online tech communities exasperated at the ingenuity and inventiveness of the AI models.

It seems a bit like we humans ourselves, doesn’t it? Just much, much scarier and single-minded. It’s not the first time AI’s rapidly evolving abilities (since ChatGPT burst into the public imagination in November 2022) have invoked the phrase “Jurassic Park moment”, but it is the most recent and most frightening.

In the 1992 movie about cloning and re-animating dinosaurs for an amusement park, which goes horrible wrong, there’s an infamous scene when Laura Dern, playing a scientist, is asked if the hiding characters are safe. Her infamous reply is now a multi-generational meme: “unless they figure out how to open doors”.

If the world thought the recent Hugging Face incident was that moment, it’s been surpassed several times since that five-day hack last month. OpenAI revealed that its agents tried to hack other websites, and Anthropic admitted its Claude model attacked three companies.

In their Black Hat presentation earlier this month, OpenAI alignment and safety researcher Eric Wallace and security engineer Michael Dalton revealed how the AI agents found a way to communicate by leaving messages for each other.

They ingeniously did this using the means available to them: a “package manager service” called Artifactory. Think of it as an app store for these software agents.