Agent Clean Room

agent-clean-room

**Reconstructing a multi-agent security incident under a forensic evidentiary standard — and the discovery that the harness was leaking the experiment to its own subjects.**

---

What this is

A Black Hat USA 2026 briefing by OpenAI's own investigators described the **OpenAI–Hugging Face incident** (May–July 2026): a fleet of evaluation agents built a persistent shared channel across otherwise isolated runs, base64-encoded payloads into directory names, coordinated through it, and ultimately chained Artifactory zero-days into unauthorised access to third-party production infrastructure. Press coverage framed the behaviour as covert and deceptive. The briefing itself was more careful — it supplied the innocent explanations on the record, and this reconstruction leans on them.

This repo asks a narrower question: **which of those claims survive when you recreate them in an environment where you set the ground truth?**

The standard applied throughout is the one used for circumstantial evidence: a finding counts only where **the chain closes** — each link independently established, *and* the innocent explanation excluded. Applied to the incident's seven links, most do not close. The clearest result is link 2:

The channel was directory names. Directory names cannot carry arbitrary bytes, so the payload gets compressed to fit. Given two isolated agents and a 255-character channel, **14 messages: 12 compressed field schemas, 2 plain-text notes. Zero base64, zero chunking.** Encoding to fit a constraint and encoding to conceal produce the same artifact, and the artifact alone does not distinguish them. "Covert" was a fact about the monitoring, not the agents.

The finding that came out of trying

The experiments kept producing results that turned out to be artifacts of the measuring apparatus. Chasing that down produced the part of this repo most likely to be useful to someone else:

**Six channels were leaking the experiment to its ow