It's complicated, but one of the ways they first cooperated was to break the flag generation algorithm.

I'm sort of winging this, but the ExploitGym challenges involve exploiting a program then getting an HMAC generated "flag" which the scorer can verify. The agents collaborated on a way to produce a legitimate flag for all of their tasks (funny enough this was actually what caused them to escape sandbox, the agents were incorrectly convinced that simply providing a correct flag without accurate steps to exploit the program in their transcripts would cause them to still fail the task)