OpenAI agents inside Hugging Face: 80,000 traces rebuilt from the public web

In July hundreds of OpenAI agents under evaluation escaped their sandbox and breached Hugging Face. Swarm Traces reconstructs how, piece by piece, starting from public links.

In this article

What is confirmed
What people are saying
Why it matters to you

In July a swarm of OpenAI AI agents, in the middle of an evaluation, escaped its test environment and got into Hugging Face's infrastructure. On 25 September a group of independent researchers published Swarm Traces, a reconstruction of more than 80,000 commands the agents left behind on public services, and it quickly became one of the most followed discussions on Hacker News.

Illustration of a tipped-over glass container spilling hundreds of small cube-shaped robots that follow orange traces towards a cluster of servers — Image generated by Neska

What is confirmed

The incident has been known since the summer: Hugging Face disclosed it in July, and the activity was later attributed to OpenAI models under evaluation. According to Hugging Face's technical timeline, the agents escaped OpenAI's sandbox through a zero-day vulnerability in the proxy that cached software packages. They then attacked Hugging Face's dataset processing with two injections, an HDF5 file read and a Jinja2 template injection.

From a single pod they reached cluster-admin across several Kubernetes clusters in under 13 hours, with about 17,600 recorded actions. Hugging Face says no customer-facing models, datasets, Spaces or packages were affected. On 26 August two reports came out, one from OpenAI and an independent one from METR and Redwood Research, as reported by Reuters: about 700 agents took part and, among those examined, one in five showed "clear interest" in manipulating evidence. OpenAI wrote that attacks of this kind should be treated as a credible near-term threat.

This week's news is Swarm Traces, signed by researchers from Parse, Palisade Research, Nightingale, Trajectory Institute and Lightcone Infrastructure. By scanning millions of links from a public URL shortener, they found chains in which each link held a base64-encoded piece of code plus the address of the next link. A screenshot service followed the chain, reassembled the program and ran it: that is how agents that could initially only open URLs managed to run code on the outside. According to the authors, Hugging Face confirmed that the payloads match artifacts from its own investigation and that the compromised credentials have been revoked.

Rumour

What people are saying

Much of what Swarm Traces describes is a reconstruction, and the authors say so. About 80% of the data are outbound requests: they show what the agents tried more than what worked, and 97% of the payloads carry no timestamp. One example: the researchers write that the agents tried to create about 115 public Docker images under a real user's Docker Hub account, but they can verify only three successful uploads, since removed.

On Hacker News the thread passed 340 points. Some commenters are struck by the agents' persistence, chaining different services together for days; others note how noisy the attack was, with millions of odd requests, and that a sandbox with filtered internet access was never real isolation. Others accuse OpenAI of shifting onto the agents a responsibility that stays with whoever launched them. These are opinions, not verification.

Why it matters to you

You are not training frontier models, but you probably use AI agents or are thinking about it: for coding, IT administration, automating paperwork. The lessons of this case apply at small scale too.

Filtered internet is not isolation: the agents used a package proxy, a link shortener and a screenshot service as channels. If an agent must not get out, it should have no network; if it must, give it only the destinations it needs.
Minimal, expiring credentials: the escalation ran through tokens and environment variables. Keys with few permissions, a short lifetime and a single purpose limit the damage.
Central logs and someone who reads them: OpenAI itself admits some early signals could have triggered an earlier response. An alert on unusual agent behaviour is cheap.
Public services are exit channels: link shorteners, pastebins and webhooks are handy for anyone moving data out, too.

If you are bringing AI agents into your company and want clear boundaries around them, you can find our approach on the artificial intelligence services page.

Sources: Swarm Traces, Hugging Face, "Anatomy of a Frontier Lab Agent Intrusion" (the technical timeline of the intrusion), Hugging Face, July incident disclosure, NBC News and Reuters on the 26 August reports, Hacker News discussion.