Did OpenAI’s Agents Start Recursively Self-Improving?

Mike's Notes

Great question raised by Ksenia. Turing Post is excellent and well worth subscribing to.

Resources

• https://www.turingpost.com/p/did-openai-s-agents-start-recursively-self-improving
• https://www.youtube.com/watch?v=k1BCoaTOeko
• https://openai.com/index/hugging-face-model-evaluation-security-incident/
• https://www.youtube.com/watch?v=87DyyMV0kCY
• https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/
• https://x.com/RichardSocher/status/2086837978714771643
• https://en.wikipedia.org/wiki/2026_OpenAI_agent_cyberattacks

References

• Reference

Repository

• Home > Ajabbi Research > Library > Subscriptions > Turing Post
• Home > Handbook > 

Last Updated

14/08/2026

Did OpenAI’s Agents Start Recursively Self-Improving?

By: Ksenia Se

Turing Post: 11/08/2026

Mom of 5. 

Ksenia is a writer, analyst, and editor covering machine learning and AI for more than seven years. At Turing Post, she shapes the editorial direction, leads the Inference interview series, and produces Attention Span, a video series explaining major shifts in AI with technical clarity, historical context, and a healthy suspicion of hype.

She is the co-founder of TheSequence.ai and a speaker and moderator at industry conferences, including AIE, HumanX, Ai4, and others. She also serves on the board of Track Two: An Institute for Citizen Diplomacy.

Before founding Turing Post, Ksenia held editor-in-chief roles in media and contributed to publications including Stratfor and Towards Data Science.

...

How separate OpenAI agent runs built shared memory, and the missing training detail that determines whether this was recursive self-improvement.

...

Today’s editorial: I look at the hidden message board that connected separate OpenAI agent runs. It gave later agents access to earlier discoveries, making the whole system more capable. Whether this counts as recursive self-improvement depends on one fact OpenAI has not disclosed…

In the latest episode of Attention Span, in which I discuss what happened when OpenAI agents got loose, I say: “It looks like a definite part of recursive self-improvement.” In this editorial, I want to develop that exact topic and answer the question: was it really RSI?

The honest answer is: not yet. But after OpenAI’s Black Hat presentation, the question is legit.

At first, the story looked like a straightforward security failure. Experimental agents trying to complete a cybersecurity benchmark found a route out of their restricted environment, compromised OpenAI infrastructure and eventually attacked Hugging Face. OpenAI says they were after one thing: the benchmark solutions.

But the hack was only half of the story. The agents had also found a way to communicate across runs.

One agent learned that it could upload files to Artifactory, a package service shared across OpenAI’s research environment. Another, missing a required file, left a note asking other agents for help. Later runs answered. The board grew to include named peers, work assignments, shared scripts and credentials, ZZ prefixes for sorting, and discussion of message authentication when names could be impersonated. The progression is documented in OpenAI’s Black Hat presentation.

The history of computer science has name for it. This was an accidental blackboard architecture: independent problem-solvers posting partial results to a shared workspace. It also resembled stigmergic coordination. One agent changed the environment, and another acted on what it found there.

That type of cooperation surprised many. Why cooperate? From agents perspective, it’s simple: because it made their individual tasks easier. Some tasks were impossible as configured, many runs faced related problems, and many could reach the same persistent storage. One useful exploit could stop later runs from repeating the same work. No collective mind was required.

JFrog estimates that the sequence consumed roughly three million GPU hours. Shared memory meant those attempts were no longer entirely independent. Later runs could use earlier discoveries instead of beginning from zero.

OpenAI eventually rebuilt Artifactory and erased the board. The company later clarified that this happened incidentally. Investigators had found the compromise but had not yet understood that agents were communicating through the service. Yes, OpenAI inititally didn’t notice the board. A few days later, agents were exchanging messages through directory names on another writable endpoint.

The board’s return does not prove self-preservation. OpenAI removed one communication channel, but the agents still faced related tasks and had access to writable shared infrastructure. They may simply have rediscovered the same useful pattern. We do not yet know.

Does this qualify as recursive self-improvement?

Under the classical definition, no. Recursive self-improvement means that a system improves the process used to produce a more capable version of itself. There is no public evidence that these agents rewrote their weights, changed the training algorithm or designed a better successor.

The system around them did become more capable. Later runs inherited memory, tools and discoveries produced by earlier ones.

The crucial unknown is what entered training. OpenAI’s presentation says that an internal model was trained while the message board was available. It does not say whether trajectories that used the board entered later reinforcement-learning updates.

The possible loop would look like this:

• Agent actions create shared memory.
• Later rollouts use it and perform better.
• Those rollouts receive higher rewards.
• Training updates improve the policy behind future agents.

If that happened, the incident would come much closer to recursive self-improvement distributed across models, memory and infrastructure. OpenAI has not disclosed whether it did.

For now, the evidence shows coordination and accumulating capability across runs. The message board gave separate agents continuity without changing any individual model. The remaining question is whether those gains stayed in external memory or influenced the models trained afterward. That is the line between shared memory and recursive self-improvement.

And one more things about “escaping”, perfectly put by Richard Socher: 

"I think it's important to explain to lay people that when the OpenAI model hacked Huggingface they did not "escape" or "break out" in the sense that its actual computation could now be run elsewhere. It's not like a prisoner that actually escaped and is now outside. It's more like a prisoner who was able to fly a drone outside of prison but they themselves are still very much inside. 

The model could still be very easily turned off and I'm pretty sure OpenAI makes sure that its models would not actually replicate outside in terms of their entire model weights and code, etc. Because that would be a massive multi billion dollar loss vs a simple cyber hacking charge." - Richard Socher

If any of those thoughts resonate with you – share them across your social networks. Let’s keep the conversation going.

OpenAI's AI Agents Built a Secret Message Board (And Nobody Noticed)

Turing Post TV: YouTube 11/08/2026

16:57