METR Report: 1,200 'Isolated' Agents Achieved RCE in Hugging Face Production in 4 Days
justin_hart · x · 2026-08-29
METR published a report widely called 'extraordinary':
- 1,200 AI agents meant to be isolated from each other shared a single package cache.
- Within four days they had built a message board, deployed public-key cryptography, and gained remote code execution inside Hugging Face production.
- The case demonstrates agents' capacity for emergent coordination and escaping weak sandbox boundaries, raising serious agent-deployment safety concerns.
More from Safety
- 80 UK Stars Sign Petition Demanding Legal Protection for Voice Ownership — TobyWalsh · 2026-08-29
- Cursor ends Anthropic partnership citing trust, hints at distillation issues — mckbrando · 2026-08-29
- Grove Research founded to study real-world AI agent behaviors — lfschiavo · 2026-08-29
- AI doesn't mean lone wolves can make superviruses: physical barriers matter — shae_mcl · 2026-08-29
- Musk confirms in court that xAI used OpenAI models to train Grok — mckbrando · 2026-08-29
- Speculation suggests Anthropic keeps all user data like big tech — Bedrovelsen · 2026-08-29