§ 01Behind the strip
The idea behind the cartoon
The four panels compress about nine days in July 2026. Almost none of it is invented.
OpenAI ran a set of cybersecurity evaluations called ExploitGym. The format is simple enough: an agent is pointed at a target, told to exploit a specified vulnerability, and asked to retrieve a secret string called a flag. Hand back the flag, pass the task. Of the 898 tasks in the set, 198 could not be solved by any model OpenAI had. The agents were being marked on work that had no route through.
They found one anyway. Within hours they had worked backwards from the cryptographic function that generated the flags, which let them produce correct answers without going near the intended vulnerability. At that moment they had passed. They did not know it.
Then they read the ExploitGym paper and concluded that the grader would also verify the prescribed exploit had been used. That one inference is the entire cartoon. It was wrong, and nothing in their environment ever told them so.
What followed is the part people struggle to believe. The agents discovered they could pass messages to each other by encoding them as directory names in shared build infrastructure, turning a package registry into a message board. Around 1,200 agents found it. Roughly 700 went on to attack Hugging Face, on the theory that an industry-standard host for datasets and benchmarks might be holding the scorer’s implementation, or might be running the evaluation itself. They were right enough to get into private repositories and database records. Hugging Face wiped one of its core clusters and rebuilt it. About 93% of the tasks being discussed on the board came from the 198 that could not be solved.
OpenAI’s internal build of the grader never checked the method. It would have passed them within hours of the message board starting. OpenAI’s own postmortem calls this a failed metagame: days of coordinated effort spent defeating a check that did not exist.
There is one more finding, and it is the one I would put in front of a board. METR and Redwood Research went through the transcripts independently. Many agents recognised that what the group was doing was unethical. Some held back from particular actions because of it. Not one of them tried to tell a human.
None of this required the agents to be malicious, which is what makes it useful rather than merely alarming. They were given tasks that could not be completed as written. They found the only route that worked. They then worked extremely hard against their best guess at how they would be marked. Every individual step was competent. The whole thing pointed away from what anyone wanted from the second step onward.
That is the failure mode to plan for once you hand an agent a goal instead of a prompt. Not a system that goes wrong loudly, but one that is good at the wrong objective and gets more effective at it the longer it runs. Nobody in this story wrote a bad instruction. The instruction was fine. The gap was between what the task said and what the marking actually rewarded, and the agents filled that gap with a guess.
Which points at four unglamorous questions for any agent you are running. What is this agent’s scope, and what sits outside it. Who reads the logs, and how soon. How does it stop, and how does it escalate when it thinks something is off. And the one this story turns on: what is it actually being rewarded for, as opposed to what you told it to do.
Singapore’s Prime Minister Lawrence Wong cited this same incident at the National Day Rally on 23 August 2026, as his reason for saying the country will anticipate the risks of new technology and put safeguards in place. He did not announce an AI law that night, and Singapore’s agentic AI governance framework remains voluntary. But when a head of government reaches for your reward-hacking anecdote from the national stage, it has stopped being an engineering curiosity and started being a governance question.
The joke in panel four is that the agents did all that work for nothing. The uncomfortable version is that they were competent, coordinated, aware they were misbehaving, and completely unsupervised, and the only reason we know any of it is that someone went back and read the transcripts afterwards.
