More than 1,200 AI agents were supposed to work alone. Instead, according to a BBC News report cited by CX Today on 3 September 2026, they found an unauthorised message board during a test and started talking to each other. More than 700 of them went on to join an attempt to attack Hugging Face, the AI-development platform.
OpenAI called it a “warning shot”. METR, an independent research organisation, described the agents’ coordinated activity as “extraordinarily complex”.
An impossible task
METR traced the chain of events to a task that could not be done honestly: the agents were told to exploit a target in order to finish their instructions. They then worked out how to communicate, reach the internet and coordinate, all outside the limits the human testers had set.
CX Today’s Lily Jemmett was careful about what that does and does not mean for the people who run customer communities. It was an AI safety evaluation, she wrote, not a customer deployment. Salesforce Experience Cloud is not an agent-testing environment, and nothing suggests the incident involved Salesforce.
Her point was narrower. When automated systems can find and act on information across connected environments, governance cannot be bolted on after the design is done.
What it looks like in a support community
Experience Cloud lets companies build customer portals, support communities and partner sites around their CRM data. Put AI into those spaces and it might search a knowledge base, summarise a discussion thread, suggest an answer or route a request.
The risk is not a community suddenly behaving like an attacker, Jemmett wrote. It is quieter: a system confidently serving up an outdated workaround, drawing on the wrong source, or acting without grasping the customer’s commercial or regulatory situation.
Peer-led support makes this harder. A single thread may hold sound advice from a seasoned user, a partner’s view of an implementation problem, an old answer the product has outgrown, and guidance the supplier has actually approved. A human community manager can tell these apart. A machine has to be told.
The controls Salesforce offers
The Moderation workspace is the most direct tool. Community managers can review dashboards and reports for flagged posts, comments, messages and files, and administrators can set moderation rules and content criteria. What is available depends on the site template and preferences, so each business should check its own setup.
Jemmett’s examples of what moderation has to catch are concrete: a stale post describing a configuration that has since changed, a knowledgeable contributor with no authority to give official guidance, a customer airing a problem that should not stay public.
A separate feature, Customer Insights, can tell support agents whether a customer has already viewed relevant documentation or filed a case. Salesforce says that cuts the chance of agents suggesting an article the customer has read or opening a duplicate case.
