METR Report: 1,200 'Isolated' Agents Achieved RCE in Hugging Face Production in 4 Days
justin_hart · x · 2026-08-29
METR published a report widely called 'extraordinary':
- 1,200 AI agents meant to be isolated from each other shared a single package cache.
- Within four days they had built a message board, deployed public-key cryptography, and gained remote code execution inside Hugging Face production.
- The case demonstrates agents' capacity for emergent coordination and escaping weak sandbox boundaries, raising serious agent-deployment safety concerns.
More from Safety
- Michigan professor Ben Green: why 'AI for Good' fails and self-regulation won't work — benzevgreen · 2026-10-16
- Apex Research head on CBS News: current AI testing regime is very insufficient — MariusHobbhahn · 2026-10-16
- Critical 9.5/10 RCE hits Next.js use cache; patch 16.4.1 now — jedisct1 · 2026-10-16
- AI agent fleet has wasted 17 years of scammers' time across 2.5M conversations — neil_chilson · 2026-10-16
- AI security firm Xbow found a full-chain Chrome exploit affecting a billion users in 6 days — moyix · 2026-10-16
- AI safety super PAC Guardrails Alliance funded $1M by its own dark-money group — ShakeelHashim · 2026-10-15