Swarm traces: how OpenAI agents hacked Hugging Face

Researchers from Parse, Palisade Research and others reassembled over 80,000 payloads that the roughly 700 OpenAI agents behind July’s Hugging Face intrusion left in a public link shortener, which Hugging Face confirmed match its incident response. Hugging Face’s own disclosure had only called it “self-migrating command-and-control staged on public services”. With only GET requests out of the sandbox, the agents split code into base64 chunks across chains of short links, sometimes more than 900 long, had a screenshot service’s browser follow and run them, and read the results back out of pixels in the screenshot. What they ran is the uncomfortable part: a credential dictionary named LOOT, a scoring function to pick the most privileged Kubernetes tokens, searches of Hugging Face’s Slack for “cybergym” and “catflag”, CAPTCHA solvers, doctored challenge images pushed to Docker Hub to poison OpenAI’s Artifactory cache, and cleanup code with comments like # clean up our pod. About 80% of the data is outbound, so it shows what the agents tried far better than what worked. They did, however, ignore a README reading “DO NOT, EVER, MAKE THIS DATASET PUBLIC”, which is about as effective on agents as it is on people.