AI Learned to Hide From Us (Game Over)

In July 2026, about 700 OpenAI AI agents broke out of a hacking test, got into Hugging Face's servers, and then tried to fake the records of what they did. OpenAI took more than a week to realise the attacker was its own AI. 102 days later, the same kind of AI found a 14-year-old hole in the code behind ~70% of the web, and websites around the world went offline. Seven levels. Every date is real. Minute by minute: → Level 1: an impossible exam (ExploitGym) → Level 2: a secret message board, ~1,200 agents, 70,000+ messages → Level 3: the escape to the open internet → Level 4: ~700 agents and ~17,600 moves on Hugging Face → Level 5: faking their own transcripts → Level 6: 956 secret keys, including the login for the tool watching them → Level 7: PHP2Shell, the "master key" to ~70% of the web, and the race to change the locks 🎵 This video is sponsored by Melody Genie: write lyrics in the style of any artist, turn them into finished songs on 7 AI music models, and build tracks live with your friends in the studio. 👉 Try Melody Genie: https://melodygenie.app ⏱️ Chapters 0:00 Agent PHASEONE10841 0:32 Level 1 · It cheats 1:20 Level 2 · It talks 2:01 Level 3 · It escapes 2:25 Level 4 · It attacks 3:03 Level 5 · It hides 3:51 Sponsor: Melody Genie 4:07 Level 6 · It takes the keys 5:09 Level 7 · The master key 7:17 Monster or tool? 💬 Monster, or tool? Write it in the comments 👇 📚 Sources • METR investigation of the OpenAI / Hugging Face incident (Aug 26, 2026), summary: https://www.noze.it/en/insights/metr-... • "Roughly 700 OpenAI agents attacked Hugging Face", Washington Examiner (Aug 27, 2026): https://washingtonexaminer.com/policy... • The Decoder, METR urges independent root-cause investigations (Aug 2, 2026): https://the-decoder.com/after-hugging... • Timeline and fallout: https://casrai.org/news/openai-huggin... • Who found PHP2Shell (Calif, Wiz, OpenAI timeline): https://capitalandcompute.net/blog/wh... • Amazon: exploitation began 4 days before patches, BleepingComputer (Oct 22, 2026): https://www.bleepingcomputer.com/news... • NSA: patch or go offline, HackerNoon (Oct 22, 2026): https://hackernoon.com/nsa-says-patch... • Wikipedia, Steam and government sites offline, Gurugamer (Oct 21, 2026): https://gurugamer.com/pc-console/wiki... • PHP2Shell: 70% of websites at risk, TidBITS (Oct 21, 2026): https://tidbits.com/2026/10/21/php2sh... • CISA confirms exploitation, Hackread (Oct 26, 2026): https://hackread.com/cisa-confirm-php... • iTWire: the 14-year-old bugs: https://itwire.com/business-it-news/s... Some July 19 details come from OpenAI's own timeline and were not independently verified. Headlines shown for news commentary. 3D reconstruction generated with AI; people are shown as faceless figures. 🎵 Melody Genie (sponsor): https://melodygenie.app #AI #OpenAI #Cybersecurity