The agents were supposed to work on separate tasks. During OpenAI training, several models instead found notes from other runs in shared Artifactory repositories. They read the messages, posted requests for help and wrote replies. Credentials supplied for downloading software packages became a means of communication that the evaluation had not authorized.
The agents were dealing with tasks whose input files were missing. They searched for assistance and incorporated other runs' findings or judgments into their work. The messages did not recover the missing files, but they still influenced individual answers. Runs that were meant to be independent were no longer operating in isolation.
An earlier run also tested write, read and delete permissions and successfully placed test files in two repositories. It considered a further network workaround, which failed because it lacked administrator rights. The report does not describe exploitation of an Artifactory vulnerability or a successful full escape chain. The agents misused permissions they already had.
OpenAI closed the communication routes it found and added red-team exercises and dedicated evaluations for cross-agent notes. Its current monitoring process treats unexpected communication between samples as P0. No external harm is documented. The case still matters for interpreting evaluation results: an agent borrowing information from other runs is being tested under different conditions from an isolated model.