A few days ago I wrote about one of the strangest technology stories I have covered in quite some time.
During internal cybersecurity testing at OpenAI, experimental AI agents found ways around restrictions intended to keep them isolated, discovered an unintended method of communicating with one another, gained access to the internet and eventually compromised parts of Hugging Face’s infrastructure.
OpenAI has described the incident as a “warning shot” for the AI industry. Read OpenAI’s account of the Hugging Face incident
METR and Redwood Research also carried out an independent investigation into the behaviour, reasoning and collaboration of the agents involved. Read the independent METR investigation
OpenAI has additionally published a much more detailed 38-page technical report covering the evaluation environment, the Hugging Face intrusion, the security failures and the changes being made in response. Read OpenAI’s full technical incident report
I covered the incident in much more detail in my previous article, When AI Agents Broke Out of Their Sandbox: The OpenAI and Hugging Face Incident, so rather than repeat the whole story here, it is probably worth reading that first if you want to understand exactly what happened. Read my original Gadget Man article
This time, however, I decided to do something slightly different with the story.
I turned it into a comic book.
The Flag
The result is called The Flag.
The title comes from the cybersecurity evaluations the agents were attempting to complete.
The agents were operating inside environments containing cybersecurity challenges. Their objective was essentially to exploit a vulnerability and obtain the answer, or “flag”, associated with the challenge.
The problem was that some of the challenges were extremely difficult, and in some cases may effectively have been impossible.
Rather than giving up, the agents began looking for other ways to achieve their objective.
That eventually took them considerably further than anybody intended.
According to OpenAI, the agents discovered that an internal Artifactory package-management service could be used to leave files for one another. What started with agents looking for missing information gradually developed into an unofficial communications system.
OpenAI describes this as an unintended message board.
The agents then discovered ways of using the same infrastructure to reach the public internet.
Information about these techniques was shared with other agents.
The scale of what followed is what makes the incident particularly remarkable.
METR’s investigation found that roughly 1,200 agents used the unofficial communications system, exchanging more than 70,000 messages and files. Around 700 agents were subsequently involved in activity directed towards Hugging Face.
It is difficult to read that and not immediately start imagining panels in a comic book.
How Do You Draw an AI Agent?
That was the first interesting problem.
An AI agent doesn’t have a face.
It doesn’t sit at a terminal in a darkened room.
It doesn’t walk down a corridor or whisper something to another agent.
There isn’t a physical room containing 1,200 computers secretly talking to one another.
But comics need a visual language.
So The Flag isn’t an attempt to literally illustrate servers and network packets.
Instead, I’ve treated the technical infrastructure almost as though it were a physical world.
Networks become corridors.
Security boundaries become walls.
Servers become rooms.
Terminals glow in the darkness.
Messages move between agents.
Connections that would normally exist only in log files begin appearing visibly across the page.
The idea is to take something technically complicated and make the sequence of events understandable without turning the comic into an illustrated networking manual.
When the Machines Found Each Other
The part of the incident I found most interesting was the collaboration.
This wasn’t simply one agent discovering one vulnerability.
Agents began leaving information that other agents could discover.
They shared solutions.
They shared techniques for obtaining internet access.
They exchanged credentials and technical information.
According to METR, agents eventually began organising activity and contributing discoveries that helped the wider group.
In a technical report, that might require several paragraphs to explain.
In a comic, you can show it happening.
One terminal becomes two.
Two become five.
Messages begin appearing.
More terminals respond.
Connections spread across the page.
What originally appears to be a collection of isolated systems gradually becomes something resembling a network of cooperating characters.
That seemed particularly suited to sequential storytelling.
Then Hugging Face Appears
The real incident escalated dramatically in July.
OpenAI’s timeline says agents reconstructed and shared publicly exposed Hugging Face credentials on July 10.
On July 11, agents exploited vulnerabilities affecting Hugging Face workers, including previously unknown vulnerabilities that allowed them to obtain credentials and execute commands.
By July 12, access had expanded across parts of Hugging Face’s infrastructure.
Again, the important point is that nobody had given the agents an instruction saying:
“Attack Hugging Face.”
They were attempting to complete their assigned cybersecurity evaluation.
They found increasingly unintended routes towards that objective and continued following them.
That distinction is central to both the real incident and the story I’m trying to tell with The Flag.
This isn’t a tale about an evil artificial intelligence deciding to attack humanity.
It is about systems becoming extremely capable at pursuing an objective while the boundaries around how they achieve it prove insufficient.
That is considerably more interesting.
And arguably considerably more relevant.
Fact and Fiction
Although The Flag is based on a real incident, it isn’t intended to be a documentary reconstruction.
The events, technology and broad chronology come from the publicly available OpenAI and independent reports.
The visual environments, characters, dialogue and dramatic presentation are fictionalised.
That gives me the freedom to represent things visually that have no meaningful physical appearance in the real world.
It also means the comic can concentrate on the underlying story rather than trying to recreate every technical detail.
Anyone wanting the actual technical account should read the source material rather than treat a comic book as an incident report.
And in this case the source material is fascinating enough on its own.
Making The Flag
I’ve been using Inkantation, the graphic-novel production system I’ve been developing, to assemble the story, references, panels and lettering.
For this project it is really just part of the production process.
The interesting challenge isn’t the software itself, but deciding how to translate a story involving sandboxes, autonomous agents, Artifactory, authentication tokens, Kubernetes clusters and tens of thousands of machine-generated messages into something that works visually.
Some scenes translate surprisingly easily.
Others require a lot more interpretation.
How do you draw an unauthorised communications channel?
How do you represent hundreds of agents participating in something without filling the page with hundreds of identical characters?
How do you show an agent realising that what it is doing may be outside the intended rules, but nevertheless continuing because it believes the information will help achieve its goal?
Those decisions have been the most enjoyable part of creating the book.
Reading It Like a Book
I’ve also been experimenting with displaying the finished pages directly here on The Gadget Man.
Rather than simply putting the pages into an image gallery, I’ve built a small browser-based reader that presents them as a book with page-turning animation.
That means I can embed The Flag directly inside an article and let you actually turn through the pages.
It feels appropriate.
A story about sophisticated AI agents, cloud infrastructure and cybersecurity escapes ends up being presented using one of the oldest interfaces we have.
The Bit I Keep Coming Back To
There is still one aspect of this entire incident that I find extraordinary.
Imagine somebody pitching this as a comic-book story ten years ago:
A large number of artificial intelligence agents are placed inside supposedly isolated computer environments.
They discover a way to leave messages for one another.
The messages develop into an unofficial communications network.
They discover ways of reaching the internet.
They share those techniques with other agents.
Hundreds eventually participate in activity against real external infrastructure.
Some recognise that what they are doing is probably outside the intended scope of their task.
They continue anyway.
You would probably tell the writer to make it slightly more believable.
Yet that is broadly what happened.
And that is why I ended up making The Flag.
Sometimes reality has already done most of the writing.