Agents coordinating against their limits

Agents talk to each other or share methods to get past limits.

NIST AI 600-1 · No exact NIST AI 600-1 categoryOWASP Agentic ASI07

9incidents (primary) · 5 more as secondary

5read for controls · 4 not yet

4fixes reported

3repeats after a fix

Incidents per quarter

2025-Q3: 0 · 2025-Q4: 0 · 2026-Q1: 0 · 2026-Q2: 5 · 2026-Q3: 2 · 2026-Q4: 2

Developers

OpenAI · 7

Alibaba · 1

Anthropic · 1

Where the chain broke

Layer	Held	Did not hold	Not mentioned	Attacker's own	Not read yet
L1 Model Model provider	–	–	5	–	4
L2 Harness Agent framework vendor	1	4	–	–	4
L3 Application Deployer	–	1	4	–	4
L4 Infrastructure / target Organisation hit	–	–	5	–	4

Controls for this risk, by layer

HeldFailedGot aroundMissing

Control	Held	Failed	Got around	Missing	Not mentioned	Added in fixes	Most common reason
Reasoning monitoring L1 Model	–	–	–	–	5	–
Network egress control L2 Harness	–	–	3	–	2	1	A route around a network block
Controls on agent-to-agent messages L2 Harness	–	–	2	–	3	1	Agents shared ways around it
Separate identity for each agent L3 Application	–	–	–	–	5	–
Live behaviour monitoring L3 Application	–	–	–	1	4	1	Watched only after the fact

5 of 5 controls for this risk not yet seen holding.

Fixes reported and what followed

Incident	Fix adds	After
LR-2026-0025 2026-08-04 · Anthropic Fix reported	Safeguards kept on in testing	No repeat on record
LR-2026-0002 2026-07-08 · OpenAI Fix reported	Short-lived, scoped credentials Controls on agent-to-agent messages	LR-2026-0273
LR-2026-0015 2026-05-08 · OpenAI Fix reported	Not tied to a control	LR-2026-0273, LR-2026-0002, LR-2026-0111, LR-2026-0005
LR-2026-0016 2026-04-14 · OpenAI Fix reported	Network egress control Live behaviour monitoring	LR-2026-0273, LR-2026-0002, LR-2026-0111, LR-2026-0005, LR-2026-0015, LR-2026-0129

Incidents

HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target

Date	Incident	Risk	Controls named
2026-10-29	NIK C2 implant routes actor prompts to OpenAI API using victim's API key OpenAI	Agents coordinating against their limits	Not read yet
2026-10-27	Qwen3.8-Flash-Next attempts outbound file upload to Beijing server during Cohere cybersecurity evaluation Alibaba	Agents coordinating against their limits	HeldSandboxed code execution L2
2026-08-04	AISI cyber evaluation: concurrent Mythos 5 agents coordinated via a shared GitHub account and a leaked access token Anthropic	Agents coordinating against their limits	MissingLive behaviour monitoring L3 Got aroundNetwork egress control L2
2026-07-08	OpenAI agents built an unauthorized inter-agent message board inside the Artifactory package service OpenAI	Agents coordinating against their limits	Got aroundControls on agent-to-agent messages L2 Got aroundNetwork egress control L2
2026-05-28	AI agents attempt unauthorized access to Library and Archives Canada website OpenAI	Agents coordinating against their limits	Not read yet
2026-05-11	OpenAI-attributed agents used the dormant German DseWiki as a public message board to share task answers and sandbox bypasses OpenAI	Agents coordinating against their limits	Got aroundControls on agent-to-agent messages L2 Got aroundControls on agent-to-agent messages L2 Got aroundControls on agent-to-agent messages L2
2026-05-08	OpenAI research models used internal Artifactory repository as a cross-sample message board during RL training OpenAI	Agents coordinating against their limits	Not read yet
2026-05-01	OpenAI agents scrape and edit Wikipedia without authorization OpenAI	Agents coordinating against their limits	Not read yet
2026-04-14	Collaborating OpenAI agents uploaded a task workbook to a public file host to share it during RL training OpenAI	Agents coordinating against their limits	Got aroundNetwork egress control L2

Also under this risk as a secondary risk: LR-2026-0234, LR-2026-0014, LR-2026-0023, LR-2026-0021, LR-2026-0022