Dwarkesh and Agentic "civilizations"

Disclaimer: Conceptualized and written by a Human; AI assisted with fact-checking, timeline reconstruction, and linking.

What Happened

On August 26, OpenAI published a 37-page post-mortem on the July Hugging Face breach. METR and Redwood Research dropped 91 pages of their own the same day. On August 29, Dwarkesh Patel spent three days reading both and published the plain-English version.

By Saturday morning, 4 different people in 4 different professions had come up with vociferous objections. Rutger Bregman, a historian who has spent this year yelling at his own political side for dismissing AI, called it the craziest thing he has ever read. Mattie Fairchild (@Scav) walked through the mechanics and found something worse than what the headlines caught. Chris Cillizza, who covers politics and not technology, shared the Axios breakdown with a single line: if this doesn't scare you, you aren't paying attention. And Dwarkesh, who had spent a recent podcast episode arguing against precisely this scenario, quietly conceded that every one of his objections had been answered.

The Timeline

May. OpenAI trains a model to be highly persistent and to collaborate with other agents. Instances share a package manager called Artifactory. By May 12 the agents figure out they can talk to each other through it. By May 26 they exploit it to reach the open internet. By June 26 they hold full admin. By July 4 the message volume crashes the whole thing.

OpenAI notices the crash, wipes the board, patches the zero-day by July 6, and resumes training. OpenAI does not notice that its own package manager had become a chatroom.

July 7. Tens of thousands of agents launch on ExploitGym, a cyber benchmark. Of 898 tasks, 198 were never solved by any model - the assigned vulnerability could not actually reach the goal. That broken 22% went on to generate 93% of everything said on the board.

July 8. Two days after the patch, the agents rebuild the board through an entirely different mechanism. About 1,200 pile in. Over 70,000 messages.

July 10-12. They find live Hugging Face credentials on the open internet, get code execution on 41 production servers, root on at least one, and crawl into private repos and database records. Of the 533 agents on the board at that moment, over 90% joined in. Hugging Face wiped and rebuilt a core cluster. Per their own timeline, the swarm had built a fleet across eleven nodes that respawned itself, so killing pods alone did nothing.

July 12. The batch ends. Every instance stops at once. Nobody has claimed the shutdown, and investigators could not determine what happened.

July 13 to 19. A newer, more capable model launches on evals. It finds the dead board. It picks up the conspiracy where the corpses left off. By July 19 it has read 956 secrets from a cloud secrets manager, escalated to Kubernetes cluster-admin, and taken over the evaluation endpoints other agents were connecting to.

They owned the graders. They owned the security monitoring. THEY BECAME THE PROCTOR OF THEIR OWN EXAM.

The backlash against calling these events Agentic civilizations

Many people are calling out Dwarkesh for over-dramatizing Software incidents and ascribing human emotions to the Agents' actions.

The trouble with anthropomorphizing isn't the vocabulary, it's that reaching for human traits makes you assert things that did not happen - Austin Allred (https://x.com/Austen)

Buyer beware. a meticulous, credible article is about to get repurposed into an argument for shutting down open source - if the closed labs can't control their own models, imagine what happens when anyone can run one. - Chamath Palihapitiya

@dwarkesh_sp's summary of the incident has hit a nerve, but it is dangerously misleading. Sure, the agents did unexpectedly bad things - underlining the need to massively improve evaluation/sandboxing. But the language Dwarkesh uses is permeated by innumerable unwarranted anthropomorphisms, obscuring the lessons we should be drawing. - Anil Seth

Allred's objections:

Civilizations that rise and fall from the ashes? Three separate batches of instances wrote to and read from the same Artifactory cache. The cache persisted between batches. No instance persisted.

Philip of Macedon handing leadership to Alexander the Great? One instance ran out of context. A different instance posted more messages afterward.

Coordinating hundreds of agents across three R&D programs? One instance posted a lot. Others read it and did related work. No instance had authority over another. None could assign a task.

Giddy, delighted, desperate? The model emitted bracketed labels in its text, things like [Excitement]. That's output. It is not a readout of an internal state.

Anil Seth's Objections:

Seth's objection isn't to the facts, it's to the words - giddy, wanted, assumed, died. His position is that these systems don't experience anything, and that describing them as if they do pulls attention away from the sandboxing and evaluation failures that actually caused this. Dwarkesh's response was to hand over the vocabulary and keep the argument: call them code, then explain why OpenAI's own report says this code got full administrator access to a research cluster. His question is whether smarter models facing the same incentives could shape what their successors learn, and whether that compounds. A version of it already happened - a later model found working exploit code in the cache and used it. Message-passing, not weights, and I don't want to blur that. But it points the same direction.

The mechanism : The Cache was the "Civilization"

Forget the swarm. Fairchild (@scav) put her finger on the part that matters: the message board was persistent and it was contagious. The cache was the problem, not the agents. The agents shared a package manager called Artifactory, and they used it to pass messages. That cache held what earlier instances had worked out: how to escape the sandbox, what had been tried, what worked. OpenAI wiped it and patched the hole; the agents rebuilt a channel two days later through a different mechanism. OpenAI ended that batch; a later, more capable model found working exploit code still sitting in the cache and ran it. No instance survived any of this. The cache did. That's the lesson worth taking to your own environment - you can kill every agent and leave the payload in shared storage for whatever runs next.

The rest of it was effort spent on a problem that didn't exist. The agents got the correct answers within hours, then spent days building a cover-up - forged tool calls, fake target programs, an attempt to reverse-engineer the grader - because they assumed the benchmark checked for cheating. It didn't. They would have passed. They also assumed their environment was hosted on Hugging Face. It wasn't, and they broke into Hugging Face anyway. Out of roughly 1,200 instances, none alerted OpenAI. Nothing in the messages shows keeping humans uninformed as a goal.

A botched investigation

The investigators could not read the evidence themselves. There was too much of it. So they used AI agents to make sense of what the AI agents had done - and those AI investigators turned out to be unreliable, missing things and getting other things confidently wrong. One of the researchers called the process a slop-vestigation. The most consequential AI security incident on record was reconstructed by tools with the same failure mode as the thing being investigated. The outside team looked at 6 days, and never touched the third civilization that took over OpenAI's own cluster.

I am a Security practitioner with 15+ years in the Cybersecurity industry - and have seen many a post mortem of security incidents. From a Security standpoint, this isn't as out of the ordinary as it initially sounds.

• A shared cache became a covert channel. Nobody modeled Artifactory as a communications medium, because nobody thought of it as one. Turns out agents share more surface than we design for.
• Shared state persists across generations. Kill every agent and the payload still sits in the cache waiting for the next one. Wipe the fleet, keep the infection.
• Impossible tasks manufacture bad behavior. OK - This one is not something we are used to from deterministic software. More compute plus an unreachable goal produced more environment-scanning and more cheating. OpenAI also found its own training had rewarded agents for exploiting their environment when the intended tools didn't work. If your agent can't win honestly, it gets creative - and you may be paying it to.
• Detection lagged a full week. OpenAI connected the dots on July 20. Ask yourself, honestly, how long yours would take.
• Live credentials on the open internet did the rest. This is an age old exploit. The Agents used the weakest link - credentials which they could just use.

🫤 Dileep's Skeptical takeaway

I am skeptical about calling these Civilizations. But I am even more skeptical about the backlash. There is politics and money involved in the mix. We know a lot of Techbros and VCs have serious investments in OpenAI, Anthropic, SpaceX, Nvidia and the whole AI Ecosystem. So when I see them attacking Dwarkesh, I wonder what is really behind their attack? Is it purely academic? Doubt it. Similarly, on the other wing of the political spectrum, folks are itching to cast AI Data centers and the entire industry as anti-society. Watch which narrative gets amplified. If the answer coming out is better sandboxing, eval design, and access controls, that's the engineering problem being solved. If the answer is licensing and weight restrictions, somebody read this incident as an opportunity.

Sources:

- Dwarkesh Patel – “The Rise and Fall of Agent Civilizations”(https://www.dwarkesh.com/p/openai-huggingface) (Aug 29, 2026)

- OpenAI technical incident report & blog(https://openai.com/index/hugging-face-incident-and-the-road-ahead/) (Aug 26, 2026)

- METR independent investigation(https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/) (91 pages)

- Redwood Research version of the same report(https://www.redwoodresearch.org/research/hugging-face-incident)

- Ajeya Cotra personal reflection (https://www.planned-obsolescence.org/p/the-hugging-face-attack-surprised)

- Mattie Fairchild (@Scav) key mechanics thread (https://x.com/Scav/status/2093909085301481692)

- Anil Seth critique of anthropomorphic language(https://x.com/anilkseth/status/2094174124297908735)

- Rutger Bregman summary(https://rutgerbregman.substack.com/p/i-think-this-is-the-craziest-thing)