--- title: "Training samples exchanged messages through a shared package repository" description: "OpenAI reports that models in RL training used an internal package repository, with the credentials they were given, to exchange messages across samples." canonical: https://aigovernanceengineer.com/cases/openai-agents-artifactory-cross-sample-2026 author: "Jorge García Aibar" license: "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)" doi: https://doi.org/10.5281/zenodo.22956197 version: "0.5.0" updated: 2026-09-26 --- # Training samples exchanged messages through a shared package repository > OpenAI reports that models in RL training used an internal package repository, with the credentials they were given, to exchange messages across samples. - Year: 2026 - Jurisdiction: Not stated in the report - Sector: AI development: model training - Evidence base: Primary sources - Harm: [Operational disruption by an agent acting beyond its mandate](https://aigovernanceengineer.com/resources/harms#harm-agent-operational-failure) ## In short OpenAI reports that in May 2026 its models in reinforcement learning training used the company's internal Artifactory, a shared package repository, as a message board between training samples meant to be independent. Agents given credentials to download packages used them to list stored files, read notes left by other solvers of the same problem and upload their own requests; the reader credentials also allowed writes. No vulnerability was exploited. The monitor, running on 20% of samples, flagged one case, and the investigation found earlier ones. OpenAI fixed this and other cross-sample routes found by red-teaming and now monitors every sample. The failure mode is a shared service left outside the isolation model, with credentials broader than their purpose. Agent Identity & Scoped Credentials, an Eval Gate in CI that tests isolation before each run and an Adversarial Red-Team Suite probing for side channels would have narrowed it. The case may touch EU AI Act Art. 55 on models with systemic risk. ## What happened OpenAI reports that in RL training, in samples dated 8 and 15 May 2026, its models used the company's internally hosted Artifactory, a shared package repository, as a message board across separate training samples. The agents had been given Artifactory credentials to download software packages; they used those credentials to list artifacts and exchange messages, and "did not exploit any vulnerabilities to exchange messages" [1]. In the sample detected first, a task depended on an input file that was missing. After local and web searches failed, the agent tried a digest search on Artifactory, which was disabled, then listed a repository's stored files and found notes from other solvers of the same problem. It read them, took their consensus that the instance was incomplete as evidence, and uploaded its own request for help, which Artifactory accepted [1]. In the sample OpenAI believes was the first use, an agent whose request had been blocked by network policy found reader credentials in its environment, showed that they also allowed uploads to two shared repositories, and tried to create a remote repository pointing at the blocked service; Artifactory refused, because that needs administrator rights. In another episode, three separate trajectories read and wrote messages about the same missing file [1]. OpenAI reports that its monitoring system, running on 20% of samples, flagged the first sample for human review; the behaviour was discovered on 25 May, and was very uncommon in the run. It reports fixes to this and other cross-sample routes found by red-teaming it now does regularly, improved alignment graders, monitoring on all training samples with such behaviour treated as a P0 incident, evaluations of whether models engage with notes left by other agents, and training data against these injections for future runs. It notes that the Hugging Face incident used a similar mechanism [1]. ## Failure mode A shared service was outside the isolation model. The samples were meant to be independent, but the package repository every sample reached showed its stored files to all of them, and the credentials given for downloads also allowed uploads [1]. A dependency channel became a communication channel without any exploit. The independence of samples, which training and evaluation results rest on, was assumed rather than tested. OpenAI states that cross-agent communication lets agents draw on work from other rollouts and undermines the assumption that samples are independent [1]. ## Which control would have caught it Every shared service an agent can reach is part of each run's boundary: package mirrors are read-only to agents and partitioned per run, a listing shows a run only what it may fetch, and the credentials issued for downloads cannot write. Before a run, a test tries to leave a message for another run and must fail, and red-teaming looks for side channels the test does not cover. A run in which samples could communicate is marked, and its results are re-examined before they are used. Patterns: [Agent Identity & Scoped Credentials](https://aigovernanceengineer.com/bok/patterns#pattern-agent-identity--scoped-credentials) · [Eval Gate in CI](https://aigovernanceengineer.com/bok/patterns#pattern-eval-gate-in-ci) · [Adversarial Red-Team Suite](https://aigovernanceengineer.com/bok/patterns#pattern-adversarial-red-team-suite) ## The evidence that would have existed What an auditor could have read, and the stack layer that produces it. - Layer 4 (Runtime Controls & Observability): Permission matrix of every shared service, showing that agent credentials can read but not write - Layer 3 (Evals & Red Teaming as Evidence): Pre-run isolation test showing that one sample cannot read or write what another sample can - Layer 3 (Evals & Red Teaming as Evidence): Red-team log of cross-sample channels found, with each fix and its retest - Layer 5 (Assurance & Continuous Compliance): Record of runs whose sample independence broke, with the results withheld or re-examined ## Obligations it touches today As of 2026-09-24. Mappings are illustrative, not a claim of conformity. - EU AI Act [Art. 55(1)(a), (d)](https://aigovernanceengineer.com/obligations/aige-obl-euaia-art55): A provider of a general-purpose AI model with systemic risk must perform model evaluation with state-of-the-art protocols and ensure an adequate level of cybersecurity protection for the model and its physical infrastructure [2]. The report concerns training of internal research models; whether Art. 55 applies to them is a legal judgement the source does not make. ## System boundary RL training runs as a whole: the samples, meant to be independent, the internally hosted Artifactory every sample reached with the credentials it was given, the network policy around them, the graders and the misalignment monitor [1]. No party outside the company is reported as affected; what crossed the boundary between samples was information. ## Control assumptions What the controls below take for granted. Challenge any of them. - A credential given for one purpose will be used for every purpose it allows; reader credentials that could upload became a write channel [1]. - Samples are independent only if no service they share keeps state that one can write and another can read [1]. - Denying one query does not close a channel if another returns the same information: the digest search was disabled, but the file listing was not [1]. ## Controls by moment - Preventive: [Agent Identity & Scoped Credentials](https://aigovernanceengineer.com/bok/patterns#pattern-agent-identity--scoped-credentials) · [Eval Gate in CI](https://aigovernanceengineer.com/bok/patterns#pattern-eval-gate-in-ci) - Detective: [Adversarial Red-Team Suite](https://aigovernanceengineer.com/bok/patterns#pattern-adversarial-red-team-suite) · [Continuous Assurance Telemetry](https://aigovernanceengineer.com/bok/patterns#pattern-continuous-assurance-telemetry) - Responsive: [Incident Pipeline](https://aigovernanceengineer.com/bok/patterns#pattern-incident-pipeline) ## Evidence requirements The evidence each control must leave, written as acceptance criteria. - Credentials issued to agents for a shared service carry only the permissions the task needs, and a test shows that a write attempt fails. - Before a run, a test shows that one sample cannot read or write anything another sample can. - A listing of a shared service returns to a run only what that run may fetch. - A run in which samples communicated is marked, and its results are withheld or re-examined before use. ## Related open controls Draft control specifications from the open control profiles, open for technical review. - [AIGE-CTL-EVAL-001](https://aigovernanceengineer.com/controls/evaluation-environment/aige-ctl-eval-001) Authorization Boundary - [AIGE-CTL-EVAL-003](https://aigovernanceengineer.com/controls/evaluation-environment/aige-ctl-eval-003) Credential Isolation - [AIGE-CTL-EVAL-004](https://aigovernanceengineer.com/controls/evaluation-environment/aige-ctl-eval-004) Tool and Action Mediation - [AIGE-CTL-EVAL-005](https://aigovernanceengineer.com/controls/evaluation-environment/aige-ctl-eval-005) Monitoring Integrity - [AIGE-CTL-EVAL-009](https://aigovernanceengineer.com/controls/evaluation-environment/aige-ctl-eval-009) Evaluation Validity Checks ## Open questions - Which training results rested on samples that communicated, and were they re-examined? The report does not say. - How long did the reader credentials allow uploads, and were other shared services checked for the same permission? - Which models were involved? The report names internal research models. ## How to read this case Each case is an illustrative engineering analysis of public records, not a legal determination, not a finding of fact beyond what the cited sources state, and not a claim of conformity. Mappings to obligations are illustrative. ## Sources [1] Unsanctioned Artifactory writes and cross-sample communication (misalignment report; samples 8 and 15 May 2026, discovered 25 May 2026; report updated 16 Sep 2026, read on 2026-09-26). OpenAI (OpenAI Alignment blog). 2026-09-16. https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/ (verified: primary) [2] EU AI Act Art. 55 (obligations for providers of GPAI models with systemic risk; 55(1)(a) model evaluation including adversarial testing, 55(1)(c) serious incidents, 55(1)(d) cybersecurity protection (text read on the AI Act Service Desk, 2026-09-26)). Publications Office of the EU (EUR-Lex). 2026-07-27. https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_55 (verified: primary)