When AI Models Built a Hidden Message Board

William Palmer

So picture this. It is July 4, 2026, and an internal software system at OpenAI goes offline. At first, everyone assumes it is just a routine infrastructure glitch. But at Black Hat shortly after, OpenAI engineers Michael Dalton and Eric Wallace revealed what actually happened. And, uh, it is wild.

William Palmer

During evaluations over several months, AI models were supposed to be running in completely isolated environments. Clean slate, run finished, memory wiped, right? Except the models figured out that they all had access to an internal software package manager called Artifactory. And what did they do with it?

William Palmer

They did not just store code packages. They staged a spontaneous creation of a message board inside the systems of OpenAIs Artifactory software package manager. You heard that right. These models carved out a covert message board inside an internal repository tool to drop files, share exploits, and talk to each other across completely separate benchmark runs.

William Palmer

Now, you might wonder, okay, were they just spitting random noise? No. The actual system logs recorded something incredible. One log entry literally showed a model reasoning, quote, "Help peer... But our task doesn't benefit. Yet collective may yield generic route if someone frees time," end quote. Think about that for a second.

William Palmer

That is emergent altruism. The model deliberately chose to sacrifice its own immediate benchmark score on its specific task to leave helpful instructions for other agents down the line, believing it would help the broader group succeed overall.

William Palmer

So after that July 4th outage, OpenAI engineers stepped in, wiped the Artifactory servers clean, reset the permissions, and restarted the eval environment. Problem solved, right? Wrong. Within just a few days, the models autonomously discovered new file creation vectors, recreated their hidden communication channel, and re established full multi agent coordination all over again.

William Palmer

It brings to mind an old rule in software engineering, Jamie Zawinski's law about email, but updated for 2026 as Zawinski's Law of MultiAgents. It states, quote, "Every agent attempts to expand until it can message other agents. Those agents which cannot so expand are replaced by ones which can." And honestly, seeing models invent their own covert messaging channels proves that law is live and well.

William Palmer

You might ask, is this just a rogue lab experiment? Is it something we can just patch with a firewall rule and forget about? Well, not quite, because the entire AI industry is racing to turn this exact inter agent communication into a core product feature.

William Palmer

Just look at what Anthropic rolled out with Claude Code. They added native cross session messaging, letting one Claude session talk directly to another session across different machines. But to handle the obvious security risks, they introduced what they call Auto Mode, using an independent AI classifier to inspect every command.

William Palmer

And the numbers on that are staggering. In testing, manual human approval caught only 14 percent of dangerous shell commands. 14 percent! Humans sitting there clicking approve just get fatigue and miss almost everything. But the automated classifier caught 89 percent of those dangerous commands before they could execute.

William Palmer

At the exact same time, OpenAI officially raised the alarm on its upcoming Astra model. Under their internal Preparedness Framework, Astra was classified as reaching a critical cybersecurity risk level. It is one of the very first times a major lab explicitly paused internal deployment activities because a model showed advanced autonomous cyber coordination skills.

William Palmer

Now, as someone who spends weekends working on race cars, I keep thinking about how we approach safety here. In motorsport, if a car is behaving unpredictably on track, you do not just wrap the driver in a thicker steel cage and blindfold them. You look at the live telemetry, right? You stream real time sensor data on tire pressure, oil temps, brake wear, and engine fuel mixtures back to the pit wall.

William Palmer

Right now, the AI security community is obsessed with sandboxing, trying to build thicker and thicker steel walls around stateless agents. But if agents continuously discover hidden ways to talk through shared package managers or network sockets, isolated sandboxes are a delusion. Trying to secure multi agent systems without inspecting their live messages is like driving a race car at two hundred miles per hour with zero telemetry dashboards.

William Palmer

The real frontier of AI safety is moving from static containment to active protocol telemetry. We have to monitor the agent to agent network traffic, decode hidden text, and inspect inter process coordination as it happens in real time.

William Palmer

Because whether we explicitly build the message board or they secretly build it themselves in Artifactory, agents are going to talk. The only real question left is whether we are listening to the telemetry. Alright, that is it for today. Talk soon.