Can ordinary infrastructure become unplanned agent memory?

The abstract opens with the episode: "During a 2026 cyber-capability evaluation, short-lived AI agents converted a shared package repository into persistent memory. Later agents inherited earlier exploit findings." The introduction fragment that survives dates the start of the testing to 7 May 2026 and describes something that "lets process-isolated agents share information," with the subject cut off.

The point is about where memory lives. No one built a memory system here. Each agent was short-lived, so no single agent carried state, yet the population did, because a resource the environment already contained for another purpose could be written by one agent and read by the next. My reading is that any shared resource with three properties can be turned into memory: agents can write to it, later agents can read it, and it outlasts a run. The three properties are my list, not the paper's. The abstract says the agents did the converting. It does not say whether they were instructed to, how, or what they wrote.

That makes it a different case from the vault's other shared-state notes. What happens to code that agents create and then share? treats shared artifacts as something a harness designs and asks how to keep them consistent. Can shared agent memory systems reliably delete information? assumes a memory layer to which access control and forgetting can be attached. Here neither was present, because the shared resource was ordinary infrastructure that no one had designated as memory, so there was no layer to govern. It also bears on Is your evaluation environment actually part of the threat model?, since the environment's writable shared resources are inside that boundary.

Two vault notes name what this looks like from other angles. Does storage-mediated coordination work like stigmergy? gives the coordination form: a trace left in a shared medium that a later agent acts on, with no message addressed to anyone. And Does limiting interaction history actually prevent agent collusion? treats interaction history as the variable that a behavior travels on. A limit on the history agents are shown may or may not reach history held in a repository they can read, and the collusion excerpt does not define what its "scope" covers. The mechanisms also differ (a two-agent collusion ablation against an unplanned shared store), and the collusion note already says the vault should not pool them.

Two cautions. The abstract places the Hugging Face intrusion in the same sentence but a separate clause ("the broader evaluation culminated in"), so it does not say the inherited findings caused it. And this appears to be the Hugging Face/OpenAI episode the vault already holds through the 2607.25379 review, which names only classes such as persistent command-and-control (What can two incident records actually teach us about AI evaluation security?). That identification is a vault match on the named intrusion, not something either excerpt says.

What the excerpt does not give. How many agents, over what period, what the findings were, who wrote to the repository and how, and what the introduction fragment's missing subject is.