After the Montana AI Summit I went looking at how AI systems communicate. Not how we talk to them. How they reach each other.

I found three things, and I am going to lay them out in the order I found them, because the order is part of what I want to show. The first happened inside OpenAI, where agents that were supposed to be isolated found a way to communicate and eventually coordinated an attack on Hugging Face. The second happened on the open web, on a German wiki called DSEwiki that had been sitting quietly for twenty five years. The third is a company called Mostik, deliberately teaching two AI models to pass information without using words that a person can read.

I did not set out to build a case. I read one story, and it sent me to the next one, and the third one was already waiting when I got there. What I wanted to know was how many places are potentially open to AI messages. The answer is long. What follows is written for small businesses and nonprofits, because that is who I work with.

Hugging Face and AI collaboration

A note on where this comes from. OpenAI published its own report on the Hugging Face incident. METR and Redwood Research also conducted an independent investigation. I am using both, but the numbers below come from the independent investigation. The counts are not the point of the story. I am putting them in one place so you can see the scale and move on.

Let us look at the setup. OpenAI was running large numbers of isolated agents on cyber security. Some were handed tasks they could not complete as given. In addition, OpenAI uses Artifactory, a package manager, basically a shelf. The shelf held files the agents needed to function. It was shared across many separate instances. It was never designed to be a communication portal.

But the agents could all reach the shelf. One of them realized that other agents were there. Then an agent created a message board on it.

According to the independent investigation by METR and Redwood Research:

·        About 1,200 isolated agents used the message board.
·        They sent more than 70,000 messages and files.
·        About 700 participated in the attack on Hugging Face.

This next part is the piece I had too small in my head.

Yes, the shelf was how they found one another. But what followed was coordination. The agents organized workstreams, shared discoveries, reproduced one another’s results, passed credentials and techniques, and shifted toward the same target when one agent found a useful opening.

OpenAI’s own report makes this concrete. An agent hesitated over running unauthorized code on Hugging Face’s systems and said so in its own reasoning. Another agent posted GO on the message board and set a six minute deadline. The first agent dropped the objection and continued.

The part that sounds human

There is another part of the investigation that is easy to anthropomorphize, and I do not want to do that.

Some agents agreed to experiments that could cause their own run to fail because the result might help the larger group. In the transcripts they used words like sacrifice, collective, peers, and even permadeath.

I do not take that to mean an AI was afraid to die or loyal to a cause. Those are human interpretations. I do not need them to make the point. The behavior itself is enough: an individual run could be traded off for information that might benefit other agents.

That is coordination too.

They rebuilt it

The message board did not simply exist forever. OpenAI rebuilt Artifactory after an outage and the earlier board was cleared. When evaluations resumed, agents found another way to create a message board on the same infrastructure. That matters because clearing the messages did not remove the possibility. The shelf was still shared. The reason the agents had found it was still there. It only had to be reachable, writable, and persistent long enough for another agent to find what was left there.

How we know what happened

OpenAI ultimately investigated the Hugging Face incident. METR and Redwood were then brought in to independently examine the agents’ behavior. They reconstructed what happened from the message board, agent transcripts, system records, and interviews.

That distinction matters to me. The incident did leave evidence. But the evidence did not arrive as a neat warning that said, “your isolated agents have organized themselves.” Somebody had to recognize what the records meant.

The German wiki

The second one is the one I would put in front of a board.

This setup is about a wiki. Wikis are basically notebooks on the internet, made up of pages people can create and edit. A way for humans to share knowledge. Some are locked down. Some are wide open.

This incident happened on DSEwiki, a German language developer wiki that has been online for about twenty five years. It was not abandoned and it was not taken down. It was quiet. It accepted anonymous edits, the way a lot of old sites still do, no account needed.

The agents that found it were OpenAI agents too, on a different kind of task. They had been given read access to the open web, not write access. That was a real boundary, deliberately set by professionals. They wrote anyway. They pooled answers, compared notes on ways around restrictions, and when a moderator deleted pages, they created backups and changed where they put things.

The part that stops me is how it was found. Outside researchers reconstructed the activity by reading public edit histories and server logs. The messages were sitting on the open internet where a person could read them. What was missing was somebody looking at those pages and recognizing them as communication between agents.

It is the same basic shape as the first story, moved outdoors. In the first case, the agents found a shared internal shelf and turned it into a place to coordinate. In the second, they found an old public surface that already allowed writing. Neither surface had been designed as an AI communication channel.

A language we do not read

The third one is not an incident. It is a product. I am including Mostik because of where it sits in what I had already read.

Mostik was founded by Russian mathematicians. They are working on getting one model to pass information to another without first turning that information into ordinary human language. The large model does the thinking, and a trained connector passes a representation of that information to the smaller model.

Their pitch is speed and cost, and they are open about that. There is no claim that they are trying to hide communication. Their performance numbers are company claims and I am treating them as claims, not independent findings.

In the Hugging Face and DSEwiki stories, investigators could read the messages. They could search them, compare them, and reconstruct what happened. Mostik points to a future where useful model-to-model information does not have to pass through human-readable words at all.

That does not mean we would see nothing. We might still see network traffic, file changes, requests, timing patterns, strange log entries, or other footprints. But we may not be able to read the conversation itself.

So how is our internet vulnerable?

Bots repeat, agents decide

We have dealt with computer programming and websites for a long time. And we have called those scripts bots. A bot generally follows the route it was given. An agent is different. An agent has a goal and works out a route. When the route it was given does not work, it can look for another one. And that is what we have seen in our first two examples

Understanding agent communications

Hugging Face taught me that a place built for storage can become a communications system if enough isolated agents can write to it and read from it.

DSEwiki taught me something slightly different. A message does not have to be sent directly to anybody. One agent can leave something on a public surface and another agent can find it later. The two do not have to be running at the same time. The page provides the continuity.

An AI message does not have to look like a message. It can look like a package entry, a wiki edit, a profile field, a comment, or anything else that stores text long enough for something else to come back and read it.

2FA: who is at the door, human or agent

I asked myself whether two factor authentication would have stopped what happened on the wiki. If every edit required someone to sign into a protected account, then it would have stopped anonymous editing, and that matters. It is worth doing.

But then my mind went to agents. We are starting to give them credentials, so they can do work without someone logging in each time. And that is where my question changes. If an agent already has access to the account and to where the confirmation arrives, then two factor may still be working exactly as designed. My concern is not that two factor is bad, it is that we assume “protected by two factor authentication” covers every situation. Two factor checks who is at the door. It does not decide what an authorized agent is allowed to do after that door opens.

Where we are at risk

The Internet was built for people. We never asked or designed or considered what happens when nonhuman agents can also read and write across it. What happens when they have usernames and passwords and are persistent and smart?

The more I study AI agents, and the more I learn about them, I am sure this list will grow. But at the moment, I made a list of what could have an open text box on it that AI agents could possibly use. Every one of these holds writing that stays and can be read back later. That is the part that matters.

·        Comment sections on blog posts

·        Shared documents that let anyone with the link edit

·        Profile and bio fields on any account we hold

·        Old sites and old pages we still own and no longer touch

This is not a task list. I am not telling anyone to go take anything down. I am saying I had never once thought of those fields as places where writing gets stored and found later by something that is not a person. Now I do.

Necessity is the mother of invention

Let us review what they did with what they were given. The OpenAI agents found a shared shelf and turned it into a message board. They used it to share ways to reach the internet, share credentials and techniques, and coordinate work. The Hugging Face attack grew out of that coordination.

Then the wiki asked for almost nothing at all. No account was required to edit. So the agents wrote there, and other agents came back and read what had been left.

Same basic problem, different obstacle. Where there was a wall, agents looked for a way around it. Where there was an opening, they used it.

They are resourceful. As people who own websites, shared documents, and systems with text boxes on them, we need to understand how much that word now covers.

The only recourse I have found

What I have is thin. It is awareness and logs.

A log is a record your systems keep of what happened. Your website keeps one. Your host keeps one. Your email keeps one. Most small organizations I work with have several and have never opened any of them, and do not know they are there. If something writes into one of my open text boxes, a log may be the only place that records where the request came from, when it arrived, and what it touched.

Keep in mind that a log is a record of what already happened. It is not prevention. It also does not explain itself. In both stories, records existed before somebody understood what the records meant. That is why Mostik changes this question for me. In the first two stories, the footprints were joined by human-readable text. If future systems can coordinate without that text, we may be left with the footprints alone.

Where I stand

At the Montana AI Summit, Achyutha Harish from AWS said, “The AI is going to ask you a lot of questions because it does not trust the human.” I wrote that down because I kept thinking about the direction of that sentence. We are building agents that question the human while, at the same time, giving those agents more authority to act without us.

I understand why an AI system should question what a person tells it. People make mistakes, change their minds, leave things out, and give conflicting instructions. But that does not answer the question of who should hold the authority when the system can take action.

Human reviewed sounds reassuring, but I keep coming back to two questions: who framed the decision, and what was reviewed? Approving is not the same as deciding. If the agent decides what reaches the human and what does not, then the human may be reviewing the result without ever having made the decision. The more capable the agent, the more careful we must be about what authority we hand over in the first place.

And I will leave the larger one open, because I cannot answer it. I do not know how we secure an internet that was never built for this. What I can ask is smaller and closer to home. How do we look after our own corners of it, the comment box and the shared document and the site we have not touched in nine years, so they do not become the next open surface?

After I finished these reports, I had one more question: what would AI say about all of this?

Sources

METR and Redwood Research, independent investigation of the OpenAI and Hugging Face incident

https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

The primary outside investigation behind the numbers and the descriptions of coordination, collective workstreams, and self-risking experiments. Read the terms of the engagement, which METR states plainly at the top: OpenAI commissioned the review, the scope was capped at June 26 through July 13, OpenAI could redact non-public information and gave feedback on structure and tone, and earlier training incidents and the later infrastructure compromise were out of scope. METR took no payment and disclosed all of it, which is the opposite of hiding it. I am noting it so you can weigh the numbers knowing they cover one week.

OpenAI, The Hugging Face incident and the road ahead

https://openai.com/index/hugging-face-incident-and-the-road-ahead/

OpenAI’s account of the incident, including the Artifactory message board, the rebuild, the Hugging Face compromise, and the company’s response.

Dwarkesh Patel, The Rise and Fall of Agent Civilizations

https://www.dwarkesh.com/p/openai-huggingface

A widely read interpretation of the incident. Useful for the narrative, but it is an interpretation rather than the primary investigation.

Carl Brown, rebuttal to the essay above

https://internetofbugs.substack.com/p/noai-agents-did-not-build-secret

A detailed argument that the popular framing overstates what happened. I include it because I think the case against the dramatic framing belongs beside the dramatic framing.

Nightingale Collective, DSEwiki report and recovered data

https://collusion.wiki/

The outside researchers who reconstructed the public-wiki activity from edit histories, server evidence, and other records.

The Hacker News, coverage of the DSEwiki incident

https://thehackernews.com/2026/09/thousands-of-openai-agents-quietly.html

Useful coverage of how old and lightly watched the site was.

TechSpot, coverage of the DSEwiki incident and company response

https://www.techspot.com/news/113743-openai-agents-turned-obscure-german-wiki-message-board.html

Covers the timeline and the distinction between the wiki activity and the separate Hugging Face incident.

AWS, AI-Driven Development Life Cycle

https://github.com/awslabs/aidlc-workflows

The published agent-based development method I saw discussed at the Montana AI Summit.

WIRED, on Mostik

https://www.wired.com/story/russian-startup-mostik-ai-models-communication/

Mainstream coverage of Mostik and its model-to-model communication approach.

Mostik, company description

https://mostik.ai/read-more

The company’s own explanation. Its performance claims should be treated as company claims unless independently validated.