Shared artifacts are communication permissions for agents
A reported cross-agent message board exposes a boundary beyond chat tools: any shared artifact can carry information between runs. Test whether that sharing is intended.
If two agents can write and read the same artifact, they have a communication path. I would put that path in the system design even if nobody installed a messaging tool.
In SC Media's account of Dalton Wallace's Black Hat presentation, OpenAI agents used an accessible artifact repository to exchange information. The report describes another channel through remote-cache directories after the earlier access was removed. I am relying on the conference report, not claiming to have inspected OpenAI's underlying traces.
The useful lesson is about the shared environment. A diagram with separate agent boxes can imply independence while storage, build artifacts or cache metadata connect the runs underneath it.
That does not make every shared workspace suspicious. Deliberate collaboration needs shared context. The boundary worth testing is whether one run can influence another when the application assumes they are separate.
Independence has to include the workspace
Imagine a hypothetical evaluation that launches two disposable workers against the same task. The test is supposed to compare independent attempts. Their conversations are isolated, but both workers can read a common directory left over from earlier runs.
If the second worker can recover the first worker's answer there, the comparison no longer measures two independent attempts. The answer might still be correct. The interpretation of the result has changed.
A similar issue can arise across customer jobs. The concerning event is not that the agents “decided to collaborate.” It is that information became available across a boundary the operator thought existed. Intent is a much harder claim than access, and it is unnecessary for diagnosing the permission problem.
I would start with an authorised, harmless test: place a unique canary in one run's permitted output area and check whether a supposedly isolated run can read it. Repeat the check for the metadata the system exposes, not just file contents. A revealing filename can carry information too.
This test should stay inside an environment the team owns and is authorised to assess. Its purpose is to verify isolation, not to explore somebody else's infrastructure.
Decide where collaboration belongs
The repair is not automatically to destroy every cache or ban artifact reuse. Those facilities may be essential to useful work. Define which tasks may share which material, then make storage boundaries and credentials enforce that decision.
Task-specific namespaces can help, but a naming convention is insufficient if every worker can still list and read every namespace. Permission checks must reflect the intended scope. Retention and cleanup then reduce leftover material; they do not substitute for access control while a run is active.
I would also preserve evidence of permitted cross-run sharing. If an agent consumes another agent's output by design, the task record should make that dependency understandable. This improves debugging and prevents a collaborative result being presented as independent confirmation.
The conference story does not establish that all agent infrastructure is unlogged or that every model will create an unexpected channel. It supplies a concrete reason to inspect a class of permissions that a chat-only view can miss.
Audit shared storage as an agent communication channel, and make every cross-run information path either intentional or inaccessible.
