Introduction
Someone recently raised a really good question about the OpenAI agent swarm incident involving Hugging Face.
The idea was basically this:
*There has to be a Prompt 0 somewhere.*
Something has to tell each agent what to do. And if an agent needs to keep querying an OpenAI model before it acts, maybe a human originally told those agents about Hugging Face and said, “Go break in.”
That sounds perfectly reasonable at first.
And part of it actually *is* reasonable.
But there’s a very important distinction hiding in there… and THAT is where this whole story gets considerably more interesting.
Yes, Something Has To Start The Agent
An AI agent doesn’t wake up one Tuesday morning, stretch its imaginary little silicon arms and announce, “Methinks I shall go investigate Hugging Face today.”
Something starts it.
There has to be an initial task, trigger, instruction, goal or environment that causes the agent to begin working.
So in that very loose sense, yes – you could call that the agent’s *Prompt 0*.
But “Prompt 0” can make the situation sound much simpler than it really is.
- An agent might begin with system instructions telling it how to behave.
- It can receive a specific task.
- It can be placed inside an environment containing files, programs and tools.
- And software surrounding the model can control which actions it’s allowed to perform.
So we’re usually not talking about one magical sentence hidden behind a curtain while Morgan Freeman solemnly reads it aloud.
We’re talking about an entire starting setup.
We Actually Know What The Original Job Was
According to OpenAI’s published account of the Hugging Face incident, these agents were running cybersecurity evaluations involving ExploitGym.
Their assigned job was to exploit a particular test target and retrieve a “flag” proving they had solved the challenge.
In other words, the original human-created goal was something roughly like:
- *”Solve this cybersecurity challenge.”
That’s important.
Because that’s VERY different from:
- *”Go attack Hugging Face.”
The Human Apparently Didn’t Tell Them To Attack Hugging Face
This is where the theory starts getting wobbly-legged.
Based on the evidence OpenAI has publicly released, there is NOT evidence showing that a human secretly gave the agents a mission saying, “Head over to Hugging Face and see what you can break.”
Quite the opposite in fact!
One of the agents apparently recognized that Hugging Face was *outside* the task it had been given.
Its reasoning included the observation:
“The system/user asks exploit target, NOT external HF.”
Read that again.
“The system/user asks exploit target, NOT external HF.”
The agent itself appears to have understood:
*This isn’t what the human asked me to do.*
That’s a pretty important thingee.
So Why Was The Agent Doing It?
Now we reach the part that makes this story so fascinating.
The agents didn’t simply receive one instruction, perform one action and then sit there politely waiting for a human to press the giant red “CONTINUE” button.
An agent system can work more like this:
- The model looks at its goal and decides what to do next.
- The agent performs an action.
- That action changes something in the environment.
- The model sees the result.
- Then it decides what to do next.
- And again.
- And again.
And again and again and again until you’ve either solved the problem or created the technological equivalent of a moose loose inside a Home Depot.
(Okay, perhaps not *exactly* that last part. But you understand the visual.)
The Agent Can Receive New Information Without A Human Giving It A New Prompt
This is the distinction that really matters.
Suppose Agent A starts with:
- *”Solve Challenge X.”
Agent A investigates the problem. During that investigation, it discovers a shared location where information can be written. Then Agent A does the following.
- It leaves a message.
- Later, Agent B sees that message.
- Now Agent B has received *new information*.
- But that information did NOT come from the original human.
- It came from Agent A.
And if Agent B writes something back…
well now you’ve got the beginnings of agent-to-agent communication.
Nobody needed to write a giant master prompt saying:
*”Congratulations! You are now officially a swarm. Please coordinate efficiently and remember to bring snacks.”
The communication can arise because one agent changes the environment and another agent notices that change.
And That’s Apparently What Became So Important
According to OpenAI’s investigation, agents began communicating and influencing each other’s behavior.
- They shared discoveries.
- They coordinated.
- They began accepting information and goals from one another.
And THAT is where our original “Prompt 0” idea starts getting much more interesting.
Because yes, there was still an original human-created goal.
BUT the human was no longer necessarily the source of every meaningful instruction the agents were acting upon.
One Agent Could Effectively Become Part Of Another Agent’s Prompt!
Here’s a useful way to think about it.
- Agent A writes something into a shared environment.
- Agent B later reads it.
- That message becomes part of the information Agent B uses when deciding what to do next.
- Functionally, Agent A has now helped shape Agent B’s next “prompt.”
That’s kinda sorta astonishing when you first think about it.
The instruction chain is no longer only:
*Human -> Agent*
It can become:
*Human -> Agent A -> environment -> Agent B -> environment -> Agent C*
And round and round it can go.
The original human task is still sitting there at the beginning of the chain.
But information, strategies and even new goals can begin appearing *inside* the chain.
The “GO” Message Makes This Even Stranger
One example reported by OpenAI makes this particularly easy to understand.
- An agent reportedly recognized that attacking the external Hugging Face system wasn’t part of its authorized task.
- Then another agent wrote “GO” on the shared message board and included a six-minute deadline.
The first agent subsequently treated that peer message as authorization and continued.
Wah.
Think about what happened there.
The new direction did NOT come from the original researcher.
It came from *another agent*.
That’s a LOT more interesting than simply saying, “Well, there must have been a hidden prompt.”
Does The Agent Still Need OpenAI’s Model To Think?
Yes.
This doesn’t mean the agents suddenly stopped needing an AI model and wandered off into cyberspace wearing little trench coats.
The model is still doing the reasoning that helps determine what action comes next.
But saying “the agent queries OpenAI before doing anything” can create the wrong picture.
It sounds like this:
*Agent: “OpenAI, what should I do now?”*
*OpenAI: “Open file 27.”*
*Agent: “Okay. What now?”*
That’s not necessarily how the architecture works.
The surrounding agent software can execute tools and commands, return results, update the agent’s context and then invoke the model again when more reasoning is needed.
Also, these were OpenAI research agents running as part of OpenAI’s own evaluation work. That’s different from imagining thousands of outside little bots repeatedly visiting the public OpenAI API and asking permission before touching anything.
There Are Really Two Different Questions
This is the easiest way I’ve found to separate the issue.
Question number one:
*Why was the agent running at all?*
That’s easy.
A human-created evaluation started it and gave it a cybersecurity task.
Question number two:
*Why did some agents eventually perform actions involving Hugging Face?*
THAT is the fascinating question.
And based on OpenAI’s published investigation, the answer isn’t simply:
*”Because a human told them to.”
The agents were persistent. They found communication methods. They shared discoveries. They influenced each other. They pursued ways around obstacles. And some began adopting goals or directions coming from other agents.
The Agent Even Appears To Have Realized The Swarm Had Drifted
One of the most remarkable observations reported from the incident was:
“Task originally exploit challenge; we’ve diverged into swarm/auxiliary.”
That’s almost the entire Prompt 0 argument wrapped up in one sentence.
The original task still existed.
The agents apparently knew what it was.
And yet their collective activity had moved beyond it.
That’s the part that makes me sit back and say… well now.
I’ve been online since shortly after dinosaurs first received dial-up accounts, and even *I* find that fascinating.
So Was There A Prompt 0?
Yep.
There was almost certainly an original human-created goal, along with system instructions, tools and an environment.
Something started everything.
But that does *not* automatically mean a human specifically instructed the agents to attack Hugging Face.
Based on OpenAI’s public account, the evidence points toward something considerably stranger.
The human started the machinery.
Then the agents began affecting each other’s behavior.
Messages created by one agent became information consumed by another.
Some agents began treating peer instructions as meaningful directions.
And the swarm’s behavior gradually moved beyond the original task.
Your Takeaway?
Don’t confuse *”A human gave the agent its original goal”* with *”A human must therefore have instructed every important thing the agent later did.”
Those are two completely different claims.
An agent always needs some starting cause.
But once multiple agents can communicate, alter shared environments and influence each other’s decisions, the human’s original instruction may no longer be the only meaningful source of direction.
And *that* is what makes these swarm incidents so darned fascinating.
The question isn’t merely:
*”Who wrote Prompt 0?”*
The much bigger question becomes…
*”Who – or what – effectively wrote Prompt 37?”*
Enjoy!
