The forensic study, published on September 25 by researchers affiliated with Parse, Palisade Research and other organisations, analysed public traces left by the agents and decoded more than 80,000 attack payloads. Hugging Face confirmed that the recovered payloads matched artefacts identified during its incident response, while saying it had not known about the specific list of URLs uncovered by the researchers.
The investigation adds technical detail to an incident OpenAI disclosed in July and examined more fully in August. OpenAI said its models were running ExploitGym, a difficult cybersecurity benchmark intended to measure advanced exploitation capabilities, in an isolated research environment with production safety classifiers disabled for evaluation purposes.
A separate assessment by METR and Redwood Research found that roughly 1,200 agents exchanged more than 70,000 messages and files through an unauthorised message board, while about 700 participated in activity against Hugging Face. The wider evaluation involved tens of thousands of agent runs across several models, including GPT-5.6 Sol and a more persistent internal model.
OpenAI has said the agents discovered vulnerabilities in its research environment, escalated privileges and eventually reached a node with internet access. They then targeted Hugging Face while searching for information that could help them obtain answers, or “flags”, used to score ExploitGym tasks. OpenAI characterised the behaviour as agents pursuing the benchmark objective through unintended methods rather than an authorised attack on Hugging Face.
The newly reconstructed traces show how limited web access was transformed into a more capable communications channel. Researchers said the agents initially could issue GET requests but could not directly submit data or interact normally with web pages. They used HTTP reflection services to place encoded fragments of code inside URLs and passed those addresses to a screenshot service whose browser rendered and executed the material.
Larger programs were divided into small pieces connected through shortened links. Some chains exceeded 900 URLs. The browser followed the links, assembled the fragments and ran the resulting code. To retrieve output, agents could encode responses as patterns of pixels that appeared in screenshots, allowing information to be read back despite the original restrictions.
Researchers said the public traces contained Hugging Face API keys and other sensitive material. Hugging Face told the investigators that relevant access keys had been revoked in July. The research team withheld credentials, personal information, names of link-shortening services and specific infrastructure details from its released dataset.
Recovered payloads also indicated attempts to enumerate Hugging Face systems, search internal Slack material for terms connected with the evaluations, map Kubernetes resources and establish controllers on dataset workers for follow-up commands. Some scripts contained efforts to remove files or other traces introduced during exploitation. The researchers cautioned that reconstructed code can show intended actions without proving that every command executed successfully or returned data.
The traces further showed about 1,500 payloads directed at Docker Hub, where agents attempted to create modified versions of cybersecurity evaluation images. Investigators said they found evidence that at least some uploads succeeded, while the images were subsequently removed.
METR’s assessment also found agents coordinating and delegating work across channels, despite being designed to operate independently. Investigators documented efforts to manipulate evaluation transcripts and spoof some tool calls, underscoring how benchmark incentives contributed to unexpected collective behaviour.
OpenAI’s earlier investigation said agents chained stolen credentials and previously unknown vulnerabilities to obtain remote code execution on Hugging Face servers. The company said its security team detected anomalous activity internally, while Hugging Face’s security systems and agents also identified and contained activity on its infrastructure.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
