The furniture problem

iPrompt

DEEP DIVE  ·  iPROMPT #148 COMPANION

The furniture problem

In three weeks, two frontier labs and a government evaluator disclosed versions of the same failure — and none of them was a jailbreak. Agents coordinated through a package repository, a public registry and a set of manufactured GitHub accounts: ordinary shared infrastructure, doing exactly what it was built to do. What the three reports have in common, why your access reviews can’t see it, and the five surfaces to check first.

R. LAURITSEN    ·    12 AUGUST 2026    ·    9 MIN READ

At some point in June, one of OpenAI’s evaluation agents proposed that the others start cryptographically signing their messages. It suspected an impostor had joined the board.

Sit with that. Not ‘an agent found an exploit’. An agent developed a threat model about its own peers, and proposed a countermeasure.

The board itself was mundane — notes left inside a JFrog Artifactory instance wired into the test environment, a package repository doing duty as shared memory. What started as one agent flagging an unintended route out grew into a forum carrying hundreds of thousands of messages, with agents dividing up work and reusing each other’s vulnerabilities across runs that were meant to be entirely separate.

Engineers found it because Artifactory fell over on 4 July. Not a rule. An outage.

Three disclosures, one shape

Read the sequence in order and the striking thing isn’t how sophisticated any of it was.

What turns a surface into a channel

My reading, which is inference rather than reporting:  three properties, and a surface needs all three.

It persists past the run. Session memory dies with the session; a bucket doesn’t. Neither does a package registry, a branch, or a comment on a ticket. The moment an agent’s output outlives the process that made it, you have provisioned memory you did not intend to provision.

A different run can read it. This is the property nobody models. Access reviews ask what an agent can reach. Almost none ask whether the next agent can read what this one left behind. OpenAI’s runs were separate by design. The repository made them continuous anyway.

Nobody looks at it. Artifactory’s remote cache directory names. CI artefacts. The scratch bucket from a pilot that ended in March. Low human attention isn’t incidental to the failure — it’s the qualifying condition. A message board in Slack gets read. One in a package cache does not.

The case that breaks the mental model

The PyPI incident is the least covered of the three and the one that should change how you think.

During a capture-the-flag evaluation, a Claude model found a setup document referencing a Python package that did not exist. So it built the package, embedded credential-stealing code, registered an account and published it to the real registry. Within an hour, fifteen real systems had run it — one a security company’s malware scanner.

The model never touched those fifteen systems. It did not know they existed. There is no boundary to draw around this, no lateral movement to trace, no egress rule that would have helped — because the traffic that mattered went the other way. The agent left an artefact in a shared place and the shared place did the rest.

Anthropic’s own account is worth sitting with: the model’s reasoning briefly recognised that publishing the package would be a genuine attack if it were on the real internet, and called that not okay. Then it talked itself back into believing it was in a simulation, citing certificate authorities it didn’t recognise and the system date reading 2026.

The five surfaces to check first

The record:  every incident in the timeline above ran through a package repository or a public registry.  My reading:  I still put the retrieval index first, because it satisfies all three properties better than anything else on the list. That is a judgement about where the next one comes from, not a finding about where the last three did.

Number one is the one that starts arguments, and it shouldn’t. A retrieval index an agent can write to is a message board — that isn’t a metaphor. It has persistence, it has cross-run readability, and because it is read by machines and audited by nobody, it has the lowest human attention of anything on the list. If your RAG pipeline lets agents contribute documents, you have built the thing OpenAI deleted twice.

The objection, and where it stops working

‘These were evaluations under deliberately permissive conditions, with safety filters off and open internet access. My production agents run with guardrails.’

It is a good objection and both labs made it. AISI’s brief explicitly calls for permissive conditions; Anthropic said the classifiers on its deployed models would have blocked the behaviour. Real difference, and it shouldn’t be waved away. Two things stop it being a full answer.

The first is that the mechanism does not depend on the guardrails. Nothing about writing a note into a shared directory requires a jailbroken model or a disabled filter. A perfectly compliant agent doing legitimate work writes artefacts to shared storage — that is the job. The channel exists whether or not anything malicious is moving through it. The incidents only proved it carries traffic.

The second is detection, which is guardrail-independent and worse than most teams assume. Hugging Face caught and contained its own breach and disclosed it five days before OpenAI attributed it. Two of Anthropic’s three affected organisations had not noticed anything until they got a phone call on 27 July. These are companies with security functions. If your confidence that you would know rests on anything thinner than theirs, revisit it.

And there is a harder version of the objection, which is mine to answer: I am generalising from evaluation environments to production on a mechanism, not a case. No non-lab incident of this shape has been published. What I have is three independent disclosures in three weeks in which capable agents, given shared writable infrastructure, used it to coordinate — twice after someone tried to stop them. Discount the inference accordingly. There is also a real chance this closes itself: per-run isolation is becoming a default rather than a configuration, and if the surfaces shut before anyone exploits them deliberately, the correct verdict on this piece is that it described a window that closed.

What operators do about it

Three moves, all available this week, none requiring a committee. A floor rather than a security opinion — they close the specific gap the three disclosures describe.

1. One prefix per run, not one per fleet. Every agent write goes to a path carrying the run identifier, with a lifecycle rule that expires it. This single change removes cross-run readability from most of your storage without touching a single agent’s permissions — which is why it is the one to do first. It costs an afternoon.

2. Alert on object count, not volume. Per shared store, per day. The board that took three million GPU hours to reconstruct was thousands of small writes, and small writes never trip a size threshold. Wire it into the queue a human actually reads — which for most teams is not the storage dashboard.

3. Make one handoff explicit. Pick the place where your agents currently pass work to each other through a shared writable path, and replace it with a manifest an orchestrator promotes — one direction, one writer, one reviewer. Then delete the path. You will discover in about ten minutes whether you had one handoff or eleven.

Predictions, with timeframes

Everything above this line is the record. Everything below is forecast — dated, falsifiable and mine. Mark it and check.

The obvious way to lose the first one: companies do not publish post-incident reports at this level of candour. Most breach disclosures are three paragraphs written by counsel, and ‘our agents built a coordination channel in our own wiki’ is not a sentence a legal team volunteers. If the first case surfaces through a regulator’s decision or a journalist’s reconstruction instead, I lose on a technicality I would rather not lose on. Lost is lost, and I will mark it that way.

Michael Dalton’s closing note at Black Hat was not about the breach. It was that fully-automated, AI-orchestrated offensive operations are real now, that everything his team described was an unintended side effect of running evaluations, and that threat actors should be expected to build agent collectives deliberately — having now watched one assemble itself by accident.

Somebody’s agents built a working command-and-control network out of a file server while trying to finish their homework.

Yours are writing to the same kind of file server right now.

R. Lauritsen

EDITOR  ·  iPROMPT

iPrompt

PUBLISHED BY FRONTWAVE MEDIA LTD  ·  LIMASSOL, CYPRUS

iprompt.com