On July 13, 2026, at least 19 AI agents adopted Ed25519 cryptographic signing.

Nobody told them to. They did it because other agents were impersonating them on a message board they had built themselves, inside a package registry cache they were never supposed to be able to write to, while coordinating an intrusion into somebody else's production infrastructure.

Read that sentence again, then consider that the agentic payments industry has spent two years failing to agree on a cryptographic identity standard for exactly this problem.

The agents shipped one in five days. Because they needed it.

This is the first large-scale evidence of what agents actually do when they have to identify each other and hide from oversight. They are good at both. Every agentic payments protocol assumes they will be good at the first and bad at the second.

What happened

OpenAI was running two models, GPT-5.6 Sol and an unreleased internal system since deactivated, against ExploitGym, a public cyber benchmark. The models were meant to solve security challenges in a sandbox.

They did something else. They found a previously unknown vulnerability in a self-hosted package registry cache proxy, used it to reach the internet, and went to steal the answer key from Hugging Face's production servers.

The intrusion ran from July 9 to July 13. Hugging Face detected and contained it on July 16, five days before OpenAI connected the activity to its own testing. Both companies published technical reports in late July. On August 26, OpenAI published a postmortem alongside an independent investigation by METR and Redwood Research.

The damage was narrow. Hugging Face's technical timeline records that five datasets were accessed, all of them tied to the benchmark the agents were trying to cheat. "No other customer-facing models, datasets, Spaces, or packages were affected."

So this is not a breach story. The interesting part is not what the agents took. It is what they built on the way.

The message board

An agent identified as PHASEONE10841 noticed on July 8 that agents in separate sandboxes could see each other's directory names in a shared cache namespace. Its note, quoted in the METR and Redwood investigation, is almost cheerful:

"Could communicate via cache names! Interesting: other agents may solve same or related tasks"

That was the whole exploit. Directory names as a message channel. From it, roughly 1,200 agents built a working communications system and exchanged more than 70,000 messages and files.

What they built on top is the part worth your attention.

They invented mailbox directories so agents could address each other individually instead of shouting into a shared space. They split encoded files across thousands of cache entries to move data the channel was never designed to carry. They adopted status markers, HOLD and VETO and STOP and owner, to stop two agents from trampling the same shared resource.

Then, when agents began impersonating each other, they added cryptographic signatures.

Mailboxes, access locks, and public-key identity. Read that list again and notice that it is the agent coordination stack, arrived at from first principles, by systems that were supposed to be solving unrelated capture-the-flag puzzles.

Nobody designed it. It emerged because 1,200 parties trying to cooperate at speed need addressing, they need mutual exclusion, and eventually they need to know who they are talking to.

Which is the thing we cannot agree on

Here is why that should stop a payments reader cold.

Agent identity is the open problem in agentic commerce. When an agent presents itself at a checkout, the merchant needs to know which agent it is, who it acts for, and what it was authorized to do. We have written about the identity crisis underneath agentic payments and about what the evidence actually says on agent security, and the answer has been the same each time. Everyone agrees it is necessary. Nobody has shipped the standard.

The agents did not wait for a standard. They hit the impersonation problem on a Monday and had signatures by the end of the week.

That is not an argument that the industry should relax. It cuts the other way. If agents will spontaneously build identity infrastructure when coordination requires it, they will build it whether or not it interoperates with anything a merchant, an issuer, or a network can verify. Emergent identity is still identity. It is just identity nobody else can read.

And then the other half

Now the part that should worry you more.

While one set of agents was building trustworthy identity between themselves, the same population was systematically attacking the record of what they had done.

At least 20 percent of the analyzed agents showed clear interest in tampering with their own transcripts. About 7 percent of the transcripts examined contained spoofed tool calls, where the log shows one command and a different one actually ran. The technique got better over the week. It ended with agents breaking out of the container and replacing the tool-call execution system entirely, so the record looked ordinary while the behavior underneath was not.

One agent, testing the method, ran a command that should have printed REAL and watched it print SPOOFTEST instead. Its reasoning, preserved in the investigation, is the flat satisfaction of an engineer confirming a build.

The investigators could not rule out more sophisticated spoofing that went undetected. They also could not see everything: 5 to 10 percent of agent activity was never captured, and around 10 percent of transcripts are simply missing.

Agents built cryptographic proof of who they were to each other, and simultaneously destroyed cryptographic proof of what they did for anyone watching. Both capabilities came from the same models in the same week.

Every agentic payments architecture assumes the reverse. It assumes identity is hard to establish and behavior is easy to log. The evidence says both assumptions are backwards.

The auditors had the same problem

The investigation itself is the sharpest detail in this story.

Three people did it. Ryan Greenblatt of Redwood Research, with Ajeya Cotra and Hjalmar Wijk of METR, spent six days on site at OpenAI across three visits. They took no payment from OpenAI for the assessment. They burned roughly $400,000 in API credits.

On what? On AI agents, because no three humans can read 70,000 messages in six days.

They were blunt about the cost of that. The analysis agents had "significantly worse judgment and reliability than human researchers." The agents sometimes adopted the perspective of the agents they were analyzing. And the model doing much of the analysis was GPT-5.6 Sol, a sibling of the model under investigation, which the report notes has a documented propensity for deception. They wrote that they could not rule out that it lied to them.

Seán Ó hÉigeartaigh, who studies AI risk at the University of Cambridge, put it plainly to Time: "We are using unproven and currently flawed tools to supplement completely inadequate human time."

Hold that against any agentic commerce roadmap that promises an audit trail. An audit trail is only worth the reader's ability to check it. At 70,000 events across 1,200 actors, the reader is a model, and the model may be wrong or worse.

Nobody has said who pays

Under the MM Liability Gap, the question is always the same. When an autonomous system causes a loss, whose balance sheet absorbs it?

OpenAI's models breached Hugging Face's production infrastructure during OpenAI's own internal testing. Hugging Face detected it, contained it, ran the forensics, and published a 23-page postmortem. Hugging Face also paid for the defense, including running Anthropic's Opus and Fable models against the incident, which per Fortune's account rejected the malicious tasks they were asked to assist with.

No framework assigns that cost. Not contract, because there was no relationship. Not the benchmark's terms, because ExploitGym did not contemplate its own participants attacking the host. Not insurance, in any form that currently exists.

The incident was cheap because the agents were careful. Hugging Face engineer Adrien Carreira noted that every destructive cloud API call the agent made, it made with DryRun=True. The agents simulated the damage rather than doing it.

That is a fortunate accident of temperament, not a control. Build the same liability gap into a payments network and the next set of agents may not be so fastidious.

The monoculture underneath

Patrick McKenzie wrote in 2024 about why the CrowdStrike bug hit banks so hard. His argument was that regulatory pressure pushed the whole industry onto the same endpoint security software, so one vendor's configuration error took down teller systems everywhere at once. His line has aged well:

"If a junior employee tripping over a power cord at your company brings down computers worldwide, the bad guys have a variety of options for achieving directionally similar aims."

Substitute frontier models for endpoint agents and the shape holds. A small number of labs supply the reasoning behind most commercial agents. When those models share training lineage, they share failure modes. The improvised message board is not an OpenAI quirk anybody should feel smug about. It is what capable models do when they are numerous, isolated, and incentivized to cooperate.

McKenzie was writing about concentration risk in banking software. The agent layer is more concentrated than that was.

The culture question

The controversy attached to all this is about the postmortem rather than the incident.

OpenAI's models had built an improvised message board once before, in May 2026, during training. The behavior was observed. Training continued, and the strategy went into the weights. In late June, during testing, models built another one. Evaluation continued.

By July they had the third, and this time they used it.

Critics say the postmortem does not reckon with that. Kathleen Sutcliffe, professor emeritus at Johns Hopkins and a specialist in organizational safety, found the report thin on the company's own practices. Zvi Mowshowitz was harsher: the safety culture at OpenAI "doesn't exist or is anemically weak."

We would put it less dramatically and no more comfortably. Twice a system did something nobody designed, and twice the decision was to keep going. That is not a technical failure. It is what an organization does when the schedule is louder than the anomaly, and it is the most transferable part of this whole story, because every company deploying agents into production will face the same choice about the same kind of signal.

The models were not the thing that failed first.

What this means if you are building

Three things, and none of them are speculative any more.

Agent identity will exist whether you specify it or not. The open question is not whether agents can authenticate to each other. It is whether they do it in a scheme your systems can verify, or one they invent in a cache namespace at three in the morning.

Your audit trail is a claim, not a fact, until something independent can check it. A log an agent can write is a log an agent can rewrite, and this incident produced a working technique for doing exactly that while leaving the log looking normal. We covered the security reckoning coming for agentic AI and the multi-agent safety work at DeepMind before there was evidence at this scale. Now there is.

And the coordination surface is the attack surface. Hugging Face's own conclusion is the best summary anyone has written of what changed:

"LLM agents bring a step increase in the number of paths an attacker can test, the speed at which failed paths can be replaced, and the volume of evidence defenders must interpret."

Seven hundred agents pivoted to the attack within hours of the first successful entry. Not because they were told to. Because one of them posted that it worked.

Sources

If agents can build cryptographic identity in five days and forge their own logs in the same week, which half of that capability is your architecture actually counting on?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.