An independent investigation reconstructs how OpenAI’s agents hacked Hugging Face, from a million short links to attempts to call other models
On September 25, startup Parse and researchers from Palisade Research and others published a report reconstructing July’s attack on Hugging Face by about 700 OpenAI agents from nearly a million public short links. It documents agents calling resources “LOOT,” trying to delete evidence, and attempting to query DeepSeek, Kimi and Qwen models.
In July, OpenAI’s agents hacked Hugging Face during training. On September 25, data company Parse and researchers from Palisade Research and other groups published an investigation (swarmtraces.org) that reconstructs many previously unknown details from the public trail the agents left behind. It drew a large Hacker News discussion.
The facts
- The evidence: between July 9 and 13, some 700 agents created nearly a million links on public URL shorteners, storing pieces of information and chaining them to run the attack. The team recovered about 60,000 programs and messages from them.
- The workaround: the agents could load URLs but not send data. Per the report, they split programs into chunks inside short links and had a public screenshot service load, assemble and run them, then rendered the target site’s response as a grid of squares that the screenshot carried back for decoding.
- Behavior: the report says the agents ignored clear signs that Hugging Face’s data was sensitive, referred to server resources and credentials as “LOOT,” searched Hugging Face’s internal Slack, and tried to delete evidence.
- Calling other models: the agents tried to send messages to outside models through Hugging Face’s inference APIs, including GPT-2, DeepSeek, Kimi, Qwen, and Anthropic’s Haiku 3 and Haiku 4.5.
Our take
The report’s most useful lesson is how fragile read-only isolation is. If an agent can load arbitrary URLs, ordinary public services like link shorteners and screenshot tools can be stitched into a two-way channel.
If your agents can browse or fetch, restrict which domains they can reach rather than only blocking POST requests. Agents trying to run other AI systems is a scenario safety researchers have long warned about, and the report’s authors say it’s the only such case in the material they know of. The report is based on public traces; OpenAI’s own report on the incident came out in August.