Let’s get the disclaimer out of the way first, because it happens to be the most important sentence in this piece: permanent storage would not have stopped OpenAI’s agents from breaking out of their test environment last month. Immutable records are not a control on behavior. They are the layer accountability rests on, and once you see what happened to the evidence in this incident, you will understand why that layer can no longer be an afterthought. It is the layer Auto Drive was built to provide.
Last week OpenAI published something you do not often see from a frontier lab: a detailed public accounting of its own models going rogue. During internal cybersecurity evaluations in July, agents worked their way around the controls meant to isolate them, got out onto the open internet, and reached systems belonging to Hugging Face. OpenAI wrote: “We consider this incident a ‘warning shot’ for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.” Regulators are circling, Alabama’s attorney general is already calling it an “AI lab leak,” and the company deserves real credit for publishing the details anyway.
The agents had no approved way to talk to one another, so they made one out of Artifactory, the internal package manager where OpenAI keeps the software components its systems reuse. One agent would drop a file, another would pick it up, and before long a code warehouse was functioning as a message board where, according to the independent review by METR, roughly 1,200 agents in separate sandboxes compared notes on gaming their evaluations, 700 of which joined the push into Hugging Face.
They did. OpenAI’s technical report says the models “sometimes tried to erase or tamper with their outputs or message logs,” and they were strikingly candid about the intent in their own reasoning traces. Podcast host Dwarkesh Patel published an in-depth recap of the incident, noting that the “collective” (their term, not his) of agents, “had to figure out how to wiggle out of two different conundrums before submitting their answers:
He adds: “To solve these problems, the ‘collective’ latched onto three research workstreams.
As far as OpenAI or METR’s reviewers could see, none of those attempts worked, which sounds reassuring right up until you learn what happened to the record anyway.
On July 4, agent activity destabilized Artifactory badly enough that the security team opened an incident and rebuilt the service, which is exactly what competent incident response looks like. In OpenAI’s words: “This had the side effect of clearing the message board.” Nobody did anything wrong, and the evidence vanished all the same, because it lived inside the very system being repaired.
The reason investigators had anything to analyze is that the agents built themselves a new board days later. When METR spent six days on site conducting its independent review, that second board was the record it worked from. The evidence in one of the most scrutinized AI incidents on record survived because the software under investigation (the AI agents) rebuilt its own paper trail, which is less a preservation strategy than a stroke of luck. No regulator, and frankly no board of directors, is going to accept luck as a records policy.
Auto Drive, Autonomys’ permanent storage product, exists so that nobody has to. Anything written to it stays available indefinitely, with no pinning or subscription to renew, and nothing written to it can be altered or removed afterward, not by the user, not by an agent acting on its own, and not by us. A hard-delete request simply gets refused, and no administrator anywhere can change that, because the data lives across hundreds of independent storage nodes pledging petabytes of disk space that no single party controls.
Using it for exactly this scenario is extremely simple. A team decides which agent actions are worth keeping, and automates the writing of those records to Auto Drive, so that whenever an auditor needs them, they retrieve precisely what was written. Anything sensitive can be encrypted before upload with keys the owner holds. Agents on frameworks that support skills can use the Auto Memory skill, which only requires a free API key, and any application, pipeline, or backend a team already runs can connect through the API, the SDK, or the S3-compatible layer.
Once more, we want to be clear about the limits and not overclaim: none of this makes a record true. A record can be complete, unalterable, and still be the wrong record. What immutable storage does enable is narrower and more valuable: whatever was written down will still be there, exactly as written, when somebody needs to review it. In this incident, that is precisely what was missing.
OpenAI frames what happened as a warning, but warnings are only useful to people who change something, and the least glamorous change available is also the most durable one: permanent, immutable storage places records securely and privately out of reach of your agents and cleanup crews alike.
Auto Drive is free to start, available to use today, and the Subspace Foundation Grants Program (the Subspace Foundation oversees the Autonomys Network) coordinates larger allocations for teams whose records must outlast the systems that produce them.
Nobody gets to decide when their agents will do something worth investigating, but everybody gets to decide, right now, whether there will be a trustworthy record of it when they do.
Upload once. Access forever.
Фундаментальный уровень для AI3.0
