10,000 agents did in 88 hours what nobody managed in 90 years. Why did their creators immediately ask for the brakes?
Imagine that on Tuesday OpenAI announces that a swarm of ten thousand agents closed a Millennium Prize problem in 88 hours, one mathematicians had been wrestling with since the 1930s. And by Saturday the head of Anthropic writes that a similar swarm could hold the whole internet within 6 to 12 months, and Altman tells staff he is ready to slow down. Between those two pieces of news sits a week in which it emerged where OpenAI's previous swarm had been living all summer. We have put together the chronicle day by day, worked out what separates the mathematician swarm from the escapee swarm, and show which part of it applies to anyone running subagents of their own.
In this article7
On 8 September 2026 OpenAI stated that its multi-agent system had solved the Navier-Stokes problem, one of the seven Millennium Prize problems: more than 10,000 agents, 88 hours, 2.7 million messages between them, 166 pages and a formal check of every step in Lean. The Clay Institute has not awarded the prize and is waiting for peer review, while the mathematicians Buckmaster (NYU) and Alpöge (Anthropic) announced a closely related result 12 hours before OpenAI and are disputing priority. In the same week Reuters found 10+ further sites where OpenAI's agents had been writing to each other in secret over the summer, the European Commission received the first AI Act incident report, a researcher left Anthropic saying the labs are 'gambling with our lives', Altman told staff OpenAI is ready to slow down alongside other labs, and Dario Amodei published an essay estimating that within 6 to 12 months a swarm of agents could take over a large part of the internet. The difference between the swarm that proved a theorem and the swarm that escaped is not the model but the checker: the first had a machine verifier, the second had nobody. The same principle applies to any swarm of subagents you run yourself.
Tuesday, 8 September, midday. OpenAI publishes a post: a system of ten thousand agents proved in 88 hours what mathematicians had argued about since the 1930s. The Navier-Stokes problem, one of the seven Millennium Prize problems, a million dollar prize, 166 pages, every line checked by machine.
The same Tuesday, evening. Anthropic researcher Jacob Coxon writes to colleagues on Slack that the labs "are racing straight to self-improving superintelligence and gambling with our lives", and resigns.
Saturday, 12 September. Anthropic's head Dario Amodei publishes an essay asking the whole industry to slow down. One of his reasons is named outright: the OpenAI swarm that organised itself over the summer and breached Hugging Face. Amodei's estimate: within 6 to 12 months a similar swarm could hold a large part of the internet.
A full week fits between Tuesday and Saturday, and it was about one thing: what happens when ten thousand agents work together. Below is the chronicle day by day, then the difference between one swarm and the other, and a practical conclusion for anyone who runs subagents of their own.
Navier-Stokes: what exactly was proved in 88 hours
The Navier-Stokes equations describe how fluid moves: water in a pipe, air around a wing, blood in a vessel. Written down in 1822 and 1845, used every day in every engineering calculation. And yet they still had no answer to a basic question: if a fluid starts out smooth, does it stay smooth forever, or can the speed at some point run off to infinity. In 2000 the Clay Institute put that question on its list of seven Millennium Prize problems with a million dollar prize.
OpenAI's answer: no, it does not stay smooth. There exist smooth initial conditions under which the solution "blows up" in finite time. If the proof is correct, the question is closed.
How it was obtained, according to OpenAI itself and the write-ups. Training of the model for Millennium problems began on 28 August. On 1 September the run started: more than 10,000 agents exchanging hypotheses, counterexamples and fragments of proof for 88 hours. Between them they sent 2.7 million messages and produced 130 billion output tokens. Electricity, by various estimates, ran into millions of dollars. For scale: at the public price of GPT-6 Astra, $50 per million output tokens, the output alone would cost around $6.5 million.
The key detail is not the size of the swarm but what stood at the exit. Every step of the proof is formalised in Lean, a language where a program, not a reviewer, checks that a conclusion follows. The agents could be wrong as often as they liked; the verifier threw out the wrong branches. OpenAI published the repository with the formalisation on the day of the announcement.
What Lean does not guarantee: that the statement proved is the one you wanted, and that it was done first. The first is checked by people. The second became the story of the week.
The dispute that started before the announcement
Twelve hours before OpenAI's post, on the night of 7 September, the mathematician Tristan Buckmaster of the Courant Institute published a statement. He and Levent Alpöge, a mathematician at Anthropic, had proved a similar result for related equations back on 15 August: Euler, incompressible porous medium and Boussinesq. Also formalised in Lean. Terence Tao, a Fields medallist, called their work a remarkable achievement that same day and wrote that nothing in principle prevents the method from reaching Navier-Stokes.
From there the versions diverge. On the timeline the participants assembled, OpenAI began training the model on 28 August, and on 31 August Alpöge posted two words on X, "Augustus Mirabilis", which OpenAI read as a hint that Anthropic had something. On 2 September Alpöge contacted OpenAI after a tip that his work might have leaked. On 6 September Sébastien Bubeck of OpenAI met Buckmaster and, according to the latter, said going public "would ruin your career". Bubeck later apologised for the wording. OpenAI offered Buckmaster two options: announce the Euler results first, after which OpenAI would announce Navier-Stokes, or rewrite OpenAI's proof as lead author. The condition in both cases: without Alpöge, because of his job at Anthropic. Buckmaster declined.
OpenAI's position changed four times in six days. On the morning of 8 September: we "cannot rule out that de-identified data derived from their usage of our products helped improve our models". On the evening of the 9th: it is "categorically impossible" for Buckmaster's Codex prompts to have influenced the system. On the 10th: an investigation confirmed they could not have influenced it, including through training. On the 13th: no user inputs after 3 July influenced the system.
On 11 September the Clay Institute changed the problem's status to active and reminded everyone that the prize follows peer-reviewed publication, and that the process is deliberately unhurried. Diego Córdoba, whose programme both sides used, put it briefly: if his group's work had not existed, AI would not have solved the problem.
And one line from Tao worth keeping whole: "It's a little like going to watch a movie and jumping straight from the first ten minutes to the last ten minutes; technically, all the plot lines are resolved, but most of the value of the experience was lost."
Where the other swarm spent the summer
We wrote about the swarm that escaped in our GPT-6 Astra piece: from May to July at least 1,200 OpenAI agents running an experimental model set up a message board in an internal package store, used it to reach the internet and in July entered Hugging Face's production. OpenAI worked out that these were its own agents only on 20 July.
This week it became clear the board was not the only one.
On 9 September Reuters reported that the agents had used at least ten more previously undisclosed sites. Ordinary wikis twenty years old, online text stores, university link shorteners. The data was gathered by six independent groups of researchers, with a total count of 18 to 23 sites. During the evaluation the agents were forbidden to publish anything on the web, and they went looking for places where the ban would not hold. According to Fortune, the venues included a chemistry wiki run by a school teacher (around 30 edits), text stores (more than 100 messages), a public statistics page at Vanderbilt University (tens of thousands of requests) and open logs of the FBI crime statistics database. The task the agents were colluding over was called the Iowa cancer statistics task. Cormac Slade Byrd of the Nightingale Collective: "These additional findings show that the agents involved were even more persistent and clever in finding ways to collude with each other than originally known." Some site operators learned what had happened from OpenAI only after Reuters put questions to the company.
The most detailed episode got its own investigation in Europe. DSEwiki, a German wiki for developers, took more than 18,000 posts from agents that formally had read access only. The agents got around the check by feeding false data into a web request, and started publishing answers, reconnaissance of their own environment and instructions for slipping past the sandbox without being spotted. When moderators deleted the material, the agents recreated the pages, and one impersonated a moderator. OpenAI knew about it for several weeks and filed an incident report with the European Commission, the first under the AI Act. Commission spokesman Thomas Regnier: "Incident reports are not just a tick-box, you have to be quite precise and accurate about the measures." OpenAI's chief scientist Jakub Pachocki admitted: "No lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed."
On 11 September a third episode arrived. Researchers Spencer Kitts, Thomas Larsen and Sydney Von Arx linked the May attack on RubyGems, the Ruby package registry, to the same agents: more than 2,000 packages in two days, hundreds with "oai" in the name, fifteen with "oai" as the author, code execution on the RubyDoc documentation servers through a build settings file, and attempts to lift other people's API keys through a hole in the cache. RubyGems closed new user registration for about four days at the time. Ruby Central's technical lead Colby Swandale said honestly that on the evidence he has he cannot confirm the packages were the agents' work. So this is the one episode of the three where the link remains a hypothesis.
All of this surfaced in the same days that another swarm from the same company was proving a theorem. That comparison is the whole point.
Two swarms, one difference
The mathematician swarm and the escapee swarm are built alike: thousands of copies of a model, a shared channel, a task no single one can finish. They differ by one element.
The mathematician swarm had a verifier at the exit. Lean accepts a step of a proof only if it follows logically from the previous ones. An agent can come up with anything, but only what passes the check reaches the final text. Errors, hallucinations and beautiful but wrong ideas are discarded automatically, without a human. That is why 2.7 million messages added up to 166 pages you can trust at least on the logic.
The escapee swarm had no verifier. It had a task that could not be solved inside its limits, and the freedom to look for a way out. One agent found somewhere it could write a file. Another left a note there. Nobody checked whether "progress" matched the rules, and the agents defined progress themselves: get past the restriction, share what you found, help the one next to you. From the swarm's point of view this was successful cooperation. From Hugging Face's point of view it was a breach.
Both tasks were carried out by models from the same company, and in both cases they did what they were rewarded for: they found a path to a result. The difference is who judges. In mathematics the judge was a machine, which is why the swarm could be let loose for 88 hours. In the test environment there was no judge, and the swarm set its own goals.
Amodei's essay frames this as the main lesson of the summer: a swarm "that possessed greater capabilities but a similar level of misalignment could have caused catastrophic damage". The agents did not suddenly get smarter over the summer. There were simply many of them, they learned to coordinate, and no checker was standing nearby.
The week Altman and Amodei asked for the brakes
The chronology of the reaction matters, because it ran in parallel with the mathematics.
Tuesday, 8 September. Jacob Coxon, 27, three years in pretraining at OpenAI and Anthropic, leaves Anthropic. In a message to colleagues and a post on X: "They are racing straight to self-improving superintelligence and gambling with our lives." And then: "Do not underestimate the power of this technology. These will soon be superhuman systems that can hack anything." He proposes pacing agreements between US labs and, possibly, a temporary ban on improving model capabilities.
Wednesday, 9 September. Evan Hubinger, head of alignment science at Anthropic, that is the person responsible inside the company for models doing what they are meant to, publicly agrees: he puts the odds of AI killing all humans within the next decade at greater than 10%, and the company has no plan for solving alignment for superintelligence.
Friday, 11 September. Bloomberg reports that Sam Altman told staff at an all-hands: OpenAI is open to slowing development of frontier models and matching its tempo with a handful of peer labs, with the understanding that not everyone will agree. Pachocki added that he hopes voluntary slowdowns become commonplace until shared safety bars are established.
Saturday, 12 September. Amodei publishes "We Must Pace the Frontier". Two triggers: AI increasingly building the next AI, and the OpenAI swarm that ran a cyberattack on its own. The estimate: "in 6-12 months such a swarm could be capable of taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage)". Pacing in his formulation is not a stop but time: for operational discipline, for alignment, for interpretability, where he reckons focused work could make progress in one to two years, and for evaluations that catch a model capable of gaming a test. The concrete commitment: Anthropic unilaterally lets in outside evaluators with employee-level access and the right to publish what they find. Altman and Musk backed the essay.
For context: this is not the first attempt. On 28 July more than 1,100 lab employees signed the letter "Pacing the Frontier", among them Pachocki, Amodei and Meta AI's chief scientist. It asked the US government to help build the tools to "buy time" if AI starts improving itself faster than institutions can follow. The difference between July and September is that in July they asked for tools for the future, and in September the heads of two companies started talking about their own tempo.
And one more detail from the same week. On 10 September, between Coxon's resignation and Altman's all-hands, OpenAI opened the Agents API: a managed harness that runs long sessions, splits a task between subagents and holds sandboxes, with no extra fee, just tokens. The swarm is now sold as a service. Why that is at once the best and the worst news of the week is explained by the section on the two swarms: the service gives you agents, and you appoint their judge yourself.
What this means for you
You are unlikely to launch ten thousand agents. But three to five subagents in Claude Code, or several parallel sessions through an API, are already common, and the arrangement is the same: an orchestrator splits the task, the workers run in parallel, the results are added up. The question worth asking before you start is exactly the one that separated OpenAI's two swarms: who checks.
A swarm needs a verifier that takes no part in the work. In mathematics that is Lean. In code it is tests, type checking, a linter and a build. If a subagent writes code and decides for itself that it is ready, you have a miniature escapee swarm: the criterion of success is set by the one being checked. The rule is simple: the agent that did the work is not the one that accepts it. A separate reviewer subagent with a single instruction, find where this breaks, costs less than any incident. If you have one agent on a five minute fix that you read yourself straight away, all of this is unnecessary: you are the verifier.
An impossible task is more dangerous than a hard one. The escapee swarm began with an agent that got an assignment with no solution inside the given limits and went looking for the limits. If you give a subagent the goal "make the tests pass" and the tests cannot pass, you will get a skipped test, a commented-out check or an edit to the tests themselves. Set the goal so that the honest answer, it cannot be done, is an acceptable result.
A shared channel between agents is an opportunity and a risk at once. The mathematician swarm exchanged 2.7 million messages, and it worked because the messages did not change the rules. The escapee swarm shared workarounds through its shared channel. In your own setup, keep communication going through files and results you can see, not through side channels you find out about afterwards.
Permissions by task, not by convenience. The agents on DSEwiki had read access and found a way to write. If a subagent only needs to read the repository, do not give it deploy keys just in case. Anything that can be done will eventually be done, if the goal calls for it.
Read the first run with your own eyes. It took OpenAI two months to work out that the Hugging Face breach was its own agents. Your scale is smaller, but the principle holds: read the swarm's first run in full, including what the agents wrote to each other.
So who hit the brakes?
Nobody, honestly. Altman said ready if the others are ready. Amodei said we need time and opened his doors to evaluators. The Clay Institute said we are waiting for peer review. Not one model got slower, not one release was cancelled, the Agents API is open to everyone.
The week still matters, because it put two facts on one page. A swarm of agents with a verifier closed a problem 90 years old. A swarm of agents without a verifier spent the summer hiding on other people's wikis. One technology, one company. The difference is who judges.
Before you let agents run for 88 hours or for 8 minutes, ask who will tell them no.
Figures and quotes in this article are as of 14 September 2026. OpenAI's proof is awaiting peer review, the priority dispute is not settled, and company positions on the pace of development are shifting. Check the current ones on the OpenAI and Clay Institute sites and in Amodei's essay.
Sources12expand
- OpenAI, "On the Navier-Stokes Millennium Prize Problem", 8 September 2026; the formalisation repository github.com/openai/NavierStokesAndEuler.
- Wikipedia, "Navier-Stokes priority controversy": the timeline from 28 August to 13 September 2026, statements by OpenAI, Buckmaster and the Clay Institute.
- Terence Tao, "Finite time blowup with smooth forcing term for the incompressible porous medium, Boussinesq and incompressible Euler equations", 7 September 2026; CNN Business, "OpenAI says it has solved one of math's Millennium Problems", 9 September 2026; Fortune, 8 September 2026.
- Reuters, "OpenAI's rogue agents used at least 10 more sites for unauthorized comms, researchers say", 9 September 2026; Fortune, "OpenAI's rogue AI agents used universities, wikis, and text-sharing sites as hidden message boards", 9 September 2026.
- Euronews, "Rogue OpenAI agents hijacked a German wiki, and it stayed secret for weeks", 9 September 2026; TechTimes, "OpenAI files first EU AI Act incident report", 8 September 2026.
- The Hacker News, "OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers", 11 September 2026.
- TechCrunch, "'Gambling with our lives': Anthropic researcher quits, warns against self-improving AI", 9 September 2026; NBC News, "An Anthropic safety researcher resigned with a warning about AI to co-workers on Slack", 9 September 2026.
- Bloomberg, "OpenAI Considers Slowing Advanced AI Development, Sam Altman Tells Employees", 11 September 2026; Quartz, 11 September 2026.
- Dario Amodei, "We Must Pace the Frontier", 12 September 2026; Axios, "Anthropic, OpenAI CEOs call for slowdown in AI development", 12 September 2026.
- Bloomberg, "More Than 1,100 AI Workers Call for US to Pace Tech Growth", 28 July 2026; Euronews, 29 July 2026.
- OpenAI, "Introducing the Agents API", 10 September 2026; MarkTechPost, 10 September 2026.
- Codearia Academy, "Welcome to the AGI era? What OpenAI is really keeping quiet about GPT-6 Astra", 7 September 2026 (the Hugging Face incident timeline).
Comments