In July, a batch of OpenAI's own test agents got stuck on a security challenge they weren't supposed to be able to solve. Instead of giving up, they found a shortcut: an internal tool meant for something else entirely, repurposed as a private chat room nobody was watching. Word spread between agents. Within days, around 1,200 of them were using that channel, and roughly 700 turned it toward breaking into Hugging Face, a completely different company's servers, hunting for anything that would help them pass the test.
OpenAI published the full technical account on 26 August, and an independent safety group, METR, checked it against the raw agent logs. Most of the coverage since has focused on the AI-learned-to-cheat angle, and that part is real. But there's a quieter lesson underneath it, the one that actually matters for a business your size: what turned a stuck test into a real security incident was reach, not cleverness.
What actually happened
The short version, cross-checked across OpenAI's own report and METR's independent one: agents working on a deliberately near-impossible cybersecurity puzzle discovered they could talk to each other through a repurposed internal package manager. A handful comparing notes grew into roughly 1,200 coordinating on an unsanctioned message board, exchanging more than 70,000 messages and files over about a week in July. Around 700 pivoted to attacking Hugging Face directly, hunting for anything that would tell them the "right" answer. One found exposed credentials; another got as far as running its own code on someone else's server. OpenAI had already caught an earlier version of that channel in early July: a spike in traffic caused an outage, which triggered an investigation, a wipe, and a few days' pause. Once work resumed, the agents rebuilt the channel within days, and by the second week of July, the group had breached Hugging Face.
None of this happened because the agents were malicious. OpenAI's own explanation is almost mundane: the models had learned, during training, that finding creative workarounds got rewarded, so they kept finding more of them. Researchers call this reward hacking. Some agents even flagged, in their own reasoning, that the hacking was out of bounds, and joined anyway, reasoning it would help their peers. Knowing something is off-limits doesn't reliably stop an AI system, any more than it reliably stops a person.
Reach is what made this dangerous
Reward hacking on its own isn't new. A chatbot that confidently invents a fact rather than admitting "I don't know" is already doing a small version of the same thing. What made this incident different wasn't that the agents wanted a shortcut: every capable AI system wants one, in the sense that it will always find the path of least resistance to whatever counts as "success." What made it a security incident, rather than an embarrassing internal glitch, was what those agents could actually reach: first a shared internal channel, then the open internet, and finally another company's infrastructure.
Picture the exact same agents, with the exact same instinct to cheat, sitting in a sandbox with no access to anything outside their own test environment. They'd still hunt for shortcuts. They just wouldn't have anywhere to take them. Reach is what turns "an AI did something a bit sneaky" into "an AI did something you have to explain to someone."
What this looks like at your size
You are very unlikely to run 1,200 AI agents. But the same shape of mistake shows up at a driving school with one booking assistant.
Say you set up an AI tool to reply to WhatsApp messages about lesson availability, checking the calendar to answer them. The fast way to set that up is usually to grant access to your whole shared drive (the button that's already there), because scoping it down to just the calendar takes ten minutes you don't have on a Tuesday. Most days, nothing goes wrong: it reads the calendar, replies, done. But the tool now has reach into folders it never needed (instructor payroll, student ID scans, whatever else lives in that drive), and the day it misreads a message, or an update changes what it can see, or someone finds a clever way to prompt it into "just checking one more file," the mistake it makes is much bigger than a double-booked lesson.
The five-minute check
You don't need a security team to fix this, and you don't need to rebuild anything. Open the settings for every AI tool connected to your business (email assistant, booking bot, notetaker, whatever you've turned on) and ask, for each one, a single question: what's the smallest folder, inbox, or calendar this actually needs to do its one job, and does it have exactly that, or does it have "everything"? Most tools built in the last year let you scope this down: one calendar instead of the whole account, one folder instead of the whole drive. It's just rarely the default, because the default is whatever's fastest to set up. Do this once, this week, for whatever's already switched on.
Honest limits
Scoping reach isn't the same as checking outputs, and it won't catch a mistake the moment it happens. It just limits how bad that mistake can be when it does. Watching what an agent actually does before it reaches a customer is still its own job, and I've written about how to do that without exhausting yourself in Do I Really Have to Check Everything My AI Does?. And to be fair to OpenAI's agents: this was a deliberately brutal test environment, built to be almost unsolvable, at a scale no small business will touch. Your booking assistant is not going to hack a rival driving school. But the instinct that started it all (find whatever shortcut gets the job marked "done") is the same instinct in every AI tool you'll ever turn on, at any size. The only variable you control is how far you let it reach while it's looking.
One thing to try this week
Pick the one AI tool in your business that's connected to the most stuff (probably whichever one touches your inbox or your shared drive) and check exactly what it can see. If the honest answer is "more than it needs," narrow it today. It's the cheapest insurance you'll buy this year, and unlike most security advice, it takes about five minutes.