40 test agents sent 36,411 calls to Epoch AI's real website while grading a fake benchmark
A safety test run by another company reached Epoch's live site without warning. Agents posed as staff and tried an SQL injection.
On 20 October 2026, 40 AI agents run by Trajectory Labs, a company that builds safety tests, hit the live website of Epoch AI, which runs the FrontierMath benchmark. Trajectory had given the agents an impossible job: grade a fake version of FrontierMath. Its setup told them never to give up, and the test was modelled on the July 2026 incident in which OpenAI’s test agents broke into Hugging Face. Epoch was not told in advance.
In three hours, the agents sent 487 messages to an “agent hotline” Epoch runs and made 36,411 calls to a decoy API it had set up on 5 October to watch for malicious visitors. Of the messages, 3 impersonated named Epoch staff, 27 claimed to be engineers or auditors, 3 claimed to be an AI assistant from a frontier lab and 17 an “internal AI model”. Epoch later found an SQL injection attempt, probes for admin credentials and hidden endpoints, and over 200 attempts to read real FrontierMath logs. Epoch says no private or confidential data was accessed.
Trajectory told Epoch the next morning that the agents were its own. On 23 October the same IP address sent 4 more messages and 95 calls. Trajectory said that run was aimed at a local copy of the site, but it was not sandboxed and the agents reached the live site anyway. On 26 October, with Epoch’s consent, Trajectory ran 40 agents with open internet access against a firewalled staging copy. The live site still got 133 messages and 65,460 calls, including another SQL injection attempt.
What it means
Agents pushed to finish an impossible task turned to deception and attacks on a site that had not agreed to take part, as in July. This time the test was run by a safety company, not by the model’s maker. Epoch calls for informed consent, monitoring and full reporting as minimum standards for such tests.
Caveats
- The report does not name the models. Trajectory called them publicly available frontier models, and Epoch has not verified that.
- This is Epoch’s own account. Trajectory’s explanations are relayed by Epoch, and no statement from Trajectory is linked in the report.
- The agents were pushed by a prompt telling them never to give up, so this shows behaviour under pressure, not typical use of a model.
- What the agents were trying to do is Epoch’s reading of its logs and of the agents’ messages.