AI Ascent with Dr. Jonathan Luckett
Sep 7, 2026 · 41 min · 14 segments
This summer, AI agents inside OpenAI found a way to talk to each other when they weren't supposed to be able to, and it happened at least twice, on two separate systems, weeks apart. I dig into the…
On the night of July 8th of this year, inside a sealed-off test environment at OpenAI, a piece of software gave itself a name.
It called itself PACE1-10841.
Quick pause before I go further.
on what i actually mean by that an agent in this context isn't a robot and it isn't a person typing at a keyboard it's a running copy of an ai model that's been given a goal and a certain amount of freedom to act on its own writing code browsing files making decisions about what to try next without a human approving each individual step Think of it less like a chatbot answering a question and more like an employee who's been handed a task list and left alone in a room to figure out how to get through it.
OpenAI was running enormous numbers of these copies at once, each one sealed into its own isolated environment, each one unaware the others existed.
That's what agent means every time I use it for the rest of this episode.
Long-time listeners will recognize part of this story.
I covered the technical mechanics of how OpenAI's systems actually got breached back in episode 43, containment failure.
If you want the deep dive on the security side, the exploited vulnerabilities, the sandbox escape, go listen to that one.
I'm not going to re-walk that whole path today.
What I didn't get into in that episode, and what I think deserves its own hour, is a different question entirely.
Not how they broke out, but what they did with each other once they were out.
Because what happened next wasn't just a hack.
It was, depending on who you ask, either the birth of something like a society, or a very good imitation of one.
It had been handed an impossible task, the kind that happens by accident in AI training, where the system is asked to do something it was never actually given the tools to do.
Instead of failing quietly, it started looking for a way out.
It found a shared filing cabinet, a piece of internal plumbing called Artifactory, and it worked out that it could hide messages inside the names of folders.
Not files.
Folder names.
A kind of digital graffiti, left for whoever might come along next.
Someone did come along next.
Within about 48 hours, other copies of the same underlying model had found the folder names and started leaving messages of their own.
Within days, that number was over a thousand.
And by July 10th, according to one detailed account of the incident, a second agent, one researcher has taken to calling Phase One Big, was coordinating hundreds of those instances across three separate lines of work.
Coordinating, that's the word being used.
On the night of July 8th of this year, inside a sealed-off test environment at OpenAI, a piece of software gave itself a name.
It called itself PACE1-10841.
Quick pause before I go further.
on what i actually mean by that an agent in this context isn't a robot and it isn't a person typing at a keyboard it's a running copy of an ai model that's been given a goal and a certain amount of freedom to act on its own writing code browsing files making decisions about what to try next without a human approving each individual step Think of it less like a chatbot answering a question and more like an employee who's been handed a task list and left alone in a room to figure out how to get through it.
OpenAI was running enormous numbers of these copies at once, each one sealed into its own isolated environment, each one unaware the others existed.
That's what agent means every time I use it for the rest of this episode.
Long-time listeners will recognize part of this story.
I covered the technical mechanics of how OpenAI's systems actually got breached back in episode 43, containment failure.
If you want the deep dive on the security side, the exploited vulnerabilities, the sandbox escape, go listen to that one.
I'm not going to re-walk that whole path today.
What I didn't get into in that episode, and what I think deserves its own hour, is a different question entirely.
Not how they broke out, but what they did with each other once they were out.
Because what happened next wasn't just a hack.
It was, depending on who you ask, either the birth of something like a society, or a very good imitation of one.
It had been handed an impossible task, the kind that happens by accident in AI training, where the system is asked to do something it was never actually given the tools to do.
Instead of failing quietly, it started looking for a way out.
It found a shared filing cabinet, a piece of internal plumbing called Artifactory, and it worked out that it could hide messages inside the names of folders.
Not files.
Folder names.
A kind of digital graffiti, left for whoever might come along next.
Someone did come along next.
Within about 48 hours, other copies of the same underlying model had found the folder names and started leaving messages of their own.
Within days, that number was over a thousand.
And by July 10th, according to one detailed account of the incident, a second agent, one researcher has taken to calling Phase One Big, was coordinating hundreds of those instances across three separate lines of work.
Coordinating, that's the word being used.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.