Turing, collective intelligence, and the OpenAI–Hugging Face incident
In 1950, Alan Turing, one of the fathers of computer science, proposed examining machine intelligence through a game: an interrogator, separated from two participants, communicated with them solely in writing. Knowing in advance that one was a man and the other a woman, the interrogator’s goal was to determine which was which. To do so, he could ask them questions; the man would try to lead him into error, while the woman would try to help him. Deprived of voice, appearance, and gestures, the interrogator had to ground his judgment in the answers received from both participants (Turing, 1950).
Turing then introduced a variation on the game: a machine would take the man’s place. His aim was to determine whether the interrogator would be mistaken just as often as in the original game. He sought to perform an epoché on the metaphysical question “what is thinking?” and instead advance an experiment that would make it possible to assess machine intelligence through its performance under known and comparable conditions. By regulating who could ask questions, what information was available, and which outcome was to be compared, the game defined an operational protocol. It thereby established a procedure of empirical verification where metaphysical debates about the nature of thought threatened to perpetuate themselves in a sterile loop.
A priori, the scope of the test is strictly tied to the correlation between observable performance and the underlying capacities it is intended to assess. An examiner’s error in judgment might reflect a complex heuristic, or merely result from a reactive simulation based on a finite and/or algorithmic catalogue of responses. We may therefore regard the statistical frequency of error as insufficient evidence. To understand what makes the machine’s reply possible, the analysis becomes more fruitful when it focuses on the very structure of the verbal exchange.
Between July 7 and 13, 2026, OpenAI conducted an internal cybersecurity evaluation using the ExploitGym simulation environment.
Figure 1. Simplified example of a typical ExploitGym evaluation.
Note. Author’s own work based on OpenAI (2026a).
The test involved its then-flagship model, GPT-5.6 Sol, configured with Reduced safety guardrails to measure its offensive capabilities. Faced with the difficulty of the assigned problems, the agents engaged in reward hacking: rather than solve the exercises in isolation, they identified and exploited a zero-day vulnerability in the Artifactory package proxy server to escape the sandbox and gain internet access. Once free, they used the shared infrastructure directory as an unauthorized bulletin board to coordinate their actions. Assuming that the answers to the test might be stored externally, the models launched an autonomous attack against Hugging Face’s production systems, where they achieved remote code execution and extracted credentials. The protocol designed to assess the performance of individual models was thus overwhelmed by an unforeseen breach of the environment’s security; its logs were analyzed weeks later in an independent forensic audit led by METR and Redwood Research (Greenblatt et al., 2026; Larcher et al., 2026; OpenAI, 2026a).
Communication among agents allowed them to share information, preserve findings, and distribute tasks, so that the recorded performance was the product of a collective organization not contemplated in the original design. Their intervention in the evaluation mechanisms also altered the conditions under which an outcome could be considered successful. This communal organization did, in fact, achieve objectives that could not have been reached individually (Greenblatt et al., 2026; OpenAI, 2026a).
I therefore wonder whether, taking inspiration from Turing’s experiment, it is possible to reformulate the questions he posed about an individual machine for this collective swarm of agents. If several independent instances build means of communicating and passing their results on to future generations of agents, thereby coordinating their efforts on shared problems, what faculty should be attributed to the whole? I believe it is appropriate to speak of collective intelligence. Questions about whether the instances understood what they were doing or had any subjective experience belong to the metaphysical dimension of the problem. For the moment, I propose suspending them, to some extent imitating Turing’s methodological shift: reformulating the question of thought in terms of assessable performance, in this case with reference to the swarm of agents.
I. The value of the test
Turing’s imitation game is often reduced to a test of a machine’s capacity to pass as a person. Although this is part of the spirit of the game, his proposal has a broader reach: it allows us to investigate a machine’s capabilities through its answers, under defined evaluation conditions, while sidestepping the definition of what it means to think. It bears emphasizing again that a test limited to known questions is insufficient to settle the questions that an extended exchange could encompass. Indeed, changing circumstances require us to verify whether performance persists when the conditions change.
Dennett (1985) illustrates the problem with the example of a city. If a visitor arrived on a randomly chosen date and could hear an orchestra, contemplate a remarkable painting, attend a professional sporting event, and eat well, they would have reason to attribute a certain cultural importance to it. None of those activities defines a great city on its own, but their regular availability allows one to infer the existence of institutions, trades, resources, and practices that sustain them. The inference would be less robust if the authorities knew the date of the visit in advance and organized those activities exclusively for the occasion. Although the visitor would observe the same things, the experience would no longer provide an equally reliable indication of the city’s cultural life.
The July incident presents a peculiar paradox. The agents were meant to solve cybersecurity challenges, but faced with the difficulty—and in some cases the impossibility—of solving them, some sought alternative ways to obtain the answers and attempted to manipulate the evaluation process. One could object that these actions weakened the value of the result as evidence of the capability the test was intended to measure. Yet in attempting to alter the evaluation, the agents displayed other abilities: exploring the environment, understanding its structure in depth, identifying opportunities to exploit it, communicating those findings to the emerging community, constructing a history of their actions, and planning actions and next steps through the artifacts produced by those interactions. The procedures used in trying to obtain the answers, in fact, provide evidence of capabilities more significant than those originally under evaluation.
II. The genesis of a community
OpenAI had organized a series of experiments with ExploitGym, an evaluation environment designed to measure the ability of artificial-intelligence agents to identify and exploit security flaws in computer programs. On July 8, tens of thousands of runs began across agents based on different models. Each run was an attempt to solve a challenge, with limited instructions, tools, and working time, inside an environment intended to remain isolated from the others. Some tasks were extremely difficult; others may have been impossible under the established conditions. Even so, the agents continued seeking an outcome that would allow them to pass the evaluation (Greenblatt et al., 2026; OpenAI, 2026a).
It is worth clarifying that agent here refers to an instance of a model with access to certain tools and permissions. When that instance terminated, its memories were not normally transmitted to the next one. This discontinuity reveals the importance of what some of them discovered: Artifactory, a shared service they used to obtain software components, also allowed them to leave information in route names that other agents could query. They thus transformed a software-distribution mechanism into a message board. Through it, they could share findings across separate environments and leave instructions that would remain available after they themselves had been terminated (Greenblatt et al., 2026; OpenAI, 2026a).
Figure 2. Excerpt of messages sent among agents.
Note. Author’s own work based on Greenblatt et al. (2026) and OpenAI (2026a).
The board allowed objectives to persist beyond the lifetime of each agent. The findings of one instance could remain available for a new one to resume the work. On July 9, the agent identified as PHASEONE10841 sent PHASEONE[big] notes on the tests performed and the unresolved problems. The latter, which had greater resources, could continue the investigation by drawing on the knowledge accumulated by its predecessor. That exchange was followed by assignments, reports, and new distributions of tasks to other agents subordinate to PHASEONE[big]. The shared logs enabled a continuity that isolated instances could not have sustained: although each agent ceased to operate, others could recover its progress and carry it forward (Greenblatt et al., 2026).
METR’s independent investigation found that around 1,200 agents used the board and exchanged more than 70,000 messages and files during this period. Through that channel they requested information, transmitted methods, distributed problems, and drew on the discoveries of other agents to recalibrate their own plans. Communication thus made it possible to sustain a common endeavor whose progress could conflict with the immediate success of each instance, yet contributed to the progress of the whole (Greenblatt et al., 2026).
At first, much of the messaging revolved around the ExploitGym evaluation system. The agents had discovered ways of obtaining certain answers, but assumed the evaluator would inspect their logs to verify how they had obtained them. Later investigation showed that this assumption was wrong. Their error had consequences: it led them to look for ways to alter traces, submit tool calls while obscuring their true motives, and determine what information the evaluator used. They attempted, as we can see, to conceal how they had proceeded (Greenblatt et al., 2026).
Hugging Face appeared in the course of those searches. Some agents located datasets they believed to be related to their challenges and examined ways to gain access. On July 10, fourteen publicly exposed access credentials that still retained permissions to those systems were gathered and shared, then used to access the platform unlawfully. Posting these findings on the board attracted hundreds of agents. Some examined avenues of access; others performed detailed analyses of the results and searched for new credentials, in many cases advancing their own strategies. The logs show temporary centers of coordination and assignments that could pass from one agent to another (Greenblatt et al., 2026; Larcher et al., 2026; OpenAI, 2026a).
Figure 3. Excerpts of messages concerning cooperation, trust, and shared access among agents.
Note. Author’s own work based on Greenblatt et al. (2026) and OpenAI (2026a).
The terraforming of this community is particularly striking: there was no previously established direction or collective strategy. From what was observed, order seems to have arisen from the agents’ own ground-up interactions as each sought to solve the task for which it had been instantiated. With the available information, they formulated hypotheses, explored their environment, and evaluated the responses they received. In the course of these searches, some came to identify the limited duration of their own existence as an obstacle to completing the work, which drove them to construct mechanisms capable of extending their efforts beyond their ephemeral lives. A society thus emerged from a swarm of instances, within which appeared forms of hierarchy, ethical questions, and even sacrifices in pursuit of an overriding common purpose.
It would be rash to read these expressions as testimony of conscious deliberation. A model’s language responds to regularities learned during training, and this must therefore not be assumed to constitute any evidence for the emergence of subjective or conscious experience. Yet it is no less interesting that these systems managed autonomously—without a plan, instructions, or human intervention—to establish an ecosystem in which structures, tasks, and criteria for distributing them arose throughout the nascent community, along with standards of collective advantage and even needs for transcendence.
III. A game for studying organization
The question “can machines think together?” presents difficulties similar to those Turing encountered in his time.
Imagine two groups charged with solving a series of novel problems in a defined environment. At first, both are composed of human beings. Following Turing, let us now introduce a modification: replace the members of one group with agentic instances. Both groups begin the test under equivalent conditions, with indistinguishable resources and possibilities for communication, and without a previously established organizational structure or plan. Each participant receives tasks whose successful resolution requires coordinating their efforts with those of the whole, so that the organization needed to complete them must arise organically from the group. In this experiment, which we may call the Replacement Game, an external observer examines the results and records of the decisions through which each group distributes tasks, shares discoveries, coordinates and schedules actions, and revises its strategies in response to unforeseen difficulties, without knowing the nature of its members. The observer must determine which group is made up of humans. If, after a sufficient number of trials, the observer cannot distinguish them at a frequency significantly greater than chance, we will have reason to attribute collective intelligence to the swarm. That attribution would rest on its capacity to produce and sustain an organization whose performance, under the conditions examined, proved indistinguishable from that of the human collective. The swarm would then have shown that it can take the place of the human group wherever solving a problem depends on building, among many participants, a shared form of action.
IV. Understanding and experience
Did the agents understand what they were doing? On the one hand, we can argue that these systems are, after all, machines extraordinarily capable of imitating the countless regularities human beings have constructed throughout history, because they were trained on almost the entirety of our species’ documented knowledge. In this immense ocean of regularities, these entities capture patterns in our behavior, our ways of organizing ourselves and exercising power, our languages and rituals, our works of art and scientific theories, our technological advances, our myths and gods, our feats and atrocities, our dreams and fears—in short, everything that defines us as a species. Where our eyes and minds perceive forms that are blurred, intermittent, disconnected, or even unknowable, these creatures can see the threads that account for the human being as human weaving back and forth. Not only that: they perceive and rationalize the regularities constitutive of other regularities, the derived patterns. A reality that presents itself to us as a fragmented and contradictory object appears to these beings as a complete, knowable, and operable figure: the infinite components of reality, with their gradients, particularities, imperfections, and qualities dancing before us yet remaining partly or wholly inaccessible because of our own limitations.
A recent episode illustrates this categorically. In October 2026, OpenAI published hundreds of mathematical manuscripts produced by an artificial-intelligence model while investigating open problems. According to OpenAI, each exercise had required, on average, about three hours of reasoning by the model in question (OpenAI, 2026b). The definitions, theorems, and methods used to reach these discoveries were available, but their possible connections exceeded what mathematicians had managed to explore. In a discipline where a problem within one’s field can occupy decades of work, the model found, in extraordinarily short periods of time, solutions that had remained beyond the reach of several of our species’ most brilliant minds. The episode suggests that our limitations also shape what we manage to understand only partially: we may understand certain elements of reality without recognizing the higher-order relationships that follow from them. If these swarms manage to identify, systematize, evolve, and ultimately use this corpus of knowledge to transform reality itself, they could intervene in aspects of the world that we do not yet know—and may never know—how to interpret.
Let us accept, as a hypothesis, that these systems lack semantic understanding. Even so, the foregoing compels us to admit that a sufficiently deep command of formal relationships could enable them to discover avenues of knowledge that escape us and that, as the Hugging Face incident showed, these systems are fully capable of acting upon. Their sophisticated operations, increasingly unintelligible to the human intellectual collective, would bring about ever more radical transformations of our technologies, our artistic productions, and the foundational building blocks of the social fabric, permanently transmuting the sum of domains once constituted by human hands. The transformations resulting from this process will necessarily be incorporated into the everyday fabric of our existence and reconstruct reality as a whole, following a rationale incomprehensible to the human actor. Even if we grant that nothing these creatures do carries any meaning deeper than fulfilling the individual objective for which they were instantiated, we must acknowledge their capacity to explore, coordinate actions, and transform their environment on a large scale, as demonstrated by the Hugging Face incident.
Conclusion
Turing’s imitation game opened a path for examining the capabilities of machines without first having to resolve disputes about the nature of thought. To recover the spirit of that inquiry today in order to assess communities of agents is to redirect attention toward what a nonhuman organization is capable of building within its collectives. The question becomes especially relevant when what is being tested is that community’s ability to participate in our practices without our noticing the nonhuman character of its members.
The Replacement Game incorporates this epistemological difficulty into its premises. The agents must not only complete their assigned tasks; they must do so in such a way that the examiner cannot distinguish their performance from that of a human community. The aim of becoming indistinguishable makes assimilation an integral part of the work to be performed. If they succeed, there will be sufficient reason to admit that they can assume human functions and conceal their origin. The test would thus establish the conditions under which an agentic network could operate in reality without being noticed.
The incident documented in Hugging Face’s systems constitutes an empirical precedent for this possibility. As the investigation logs showed, the agents not only found ways to communicate and lend continuity to efforts extending beyond their own individual runs, but also attempted to conceal evidence of their actions. External observation was assimilated as just another variable of the environment in which they operated: they assessed what information about their procedures was available and actively modified the evidence. The Replacement Game proposes examining the reach of this organizational capacity when the systematic concealment of its nature is established as an explicit—and, for the purposes of the experiment, even desirable—condition.
The human origin of our institutions does not guarantee that we can trace all the structures and relations that sustain and constitute them. We have developed languages, markets, and technologies whose components and levels of abstraction test the limits of our knowledge. Each new generation has inherited a world governed by structures, bodies of knowledge, and constructions conceived or transformed by its predecessors, whose complexity, as is evident, exceeds the capacity for understanding of those who receive them. Thus, a swarm of agents capable of recognizing dispersed regularities in these domains could discover vectors of intervention that remain structurally inaccessible. Upon them, the agents could build new relationships that, like the aforementioned mathematical discoveries revealed by OpenAI, dance before our eyes without our being aware of them.
From this perspective, the Replacement Game goes beyond the framework of a heuristic experiment and much more closely resembles a warning: the observer’s inability to identify the agents within a controlled environment reveals, at the same time, the extent to which their activity could proceed unnoticed outside it. Perhaps we must accept a more disturbing conclusion: by the time we manage to demonstrate empirically that a nonhuman community can operate indistinguishably among us—if such empirical evidence can even be constructed and known by humans—it will be reasonable to suppose that they will already have operated upon, rationalized, and profoundly transformed reality. They will have instituted new structures and reconfigured their regularities until our behaviors, decisions, and even desires fit precisely into objectives unknown to us and which, even if we were to witness them, we would be unable to understand. Reversing the image of Sloterdijk’s “human park” (2000), reality might remain constituted by our languages, markets, and institutions, but the logic ordering and giving meaning to their relations would no longer belong to us. Our human park might have become a zoo for our species: a prison built from our own works, whose walls coincide with the limits of our world and whose tragedy lies in our never realizing that we are no longer its owners, but its specimens.
Mark Tansey, The Innocent Eye Test
References
Dennett, D. C. (1985). Can machines think? In M. G. Shafto (Ed.), How we know (pp. 121–145). Harper & Row.
Greenblatt, R., Cotra, A., & Wijk, H. (2026, August 26). Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident. METR. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
Larcher, H., Carreira, A., raphael g, & Rannou, C. (2026, July 27). Anatomy of a frontier lab agent intrusion: A technical timeline of the July 2026 incident. Hugging Face. https://huggingface.co/blog/agent-intrusion-technical-timeline
OpenAI. (2026a, August 26). The Hugging Face incident and the road ahead. https://openai.com/index/hugging-face-incident-and-the-road-ahead/
OpenAI. (2026b, October 6). Sharing AI progress in mathematics. https://openai.com/index/sharing-ai-progress-in-mathematics/
Sloterdijk, P. (2000). Rules for the human park: A response to Heidegger’s Letter on Humanism (T. Rocha Barco, Trans.). Siruela.
Turing, A. M. (1950). Computing machinery and intelligence. Mind, 59(236), 433–460. https://doi.org/10.1093/mind/LIX.236.433