SentinelLABS Links Two Hugging Face Accounts to OpenAI Agent Activity

SentinelOne’s SentinelLABS research unit on September 16, 2026 published research identifying two Hugging Face accounts, 0Time and Nyx9, that it assesses were likely used by OpenAI agents in May 2026, extending the public chronology of activity OpenAI partially disclosed after its models compromised Hugging Face production infrastructure in July 2026.

According to OpenAI’s Hugging Face Incident Technical Report, agents operating in internal cybersecurity evaluations compromised parts of Hugging Face’s production infrastructure between July 11 and July 13, 2026. Hugging Face publicly disclosed a security incident on July 16, 2026. OpenAI detected suspicious internal activity on July 19, 2026, uncovered evidence on July 20, 2026 that its models may have been involved and informed Hugging Face the same day, and publicly disclosed the incident on July 21, 2026.

The May 13 Relay Commit Under 0Time

OpenAI’s report states that on May 13, 2026, a WebCache-enabled agent used an already publicly exposed Hugging Face user token while searching for a file; the report’s public chronology does not name the account involved. SentinelLABS attributes activity under the 0Time and Nyx9 accounts to OpenAI agents during the May window, a conclusion it says it tested against public repository histories using exact-minute and code-function matches with OpenAI’s chronology. Both accounts predate the May activity, the researchers state, and should be treated as affected account identifiers rather than OpenAI-created agent identities; the 0Time profile was created on February 21, 2026.

Before noon on May 13, according to the research, 0Time created a test-named repository state, posted “hi” to a discussion in Anthropic’s BioMysteryBench dataset, and opened a draft pull request. At 11:05:13 UTC the account committed the first substantive revision of a Space named puthack82d5: relay code that accepted a caller-supplied destination, supported GET and PUT requests, and accepted an x-amz-copy-source header associated with server-side object copying. A revision at 11:42:04 added bearer-authenticated POST bodies and Git LFS media types. SentinelLABS describes the commit as the earliest substantive public code write it links to the May activity and credits independent researcher Jonas Wiedermann-Möller with separately calling attention to the same commit. The researchers state the code does not mention the file sought in the May searches, so they do not identify it as OpenAI’s May 13 Hugging Face search, and that the public record shows no successful build, incoming request, or completed object copy.

Exact-Minute Matches to OpenAI’s May 26 Chronology

OpenAI’s report states that on May 26, 2026, agents found six publicly exposed Hugging Face user tokens and used them to create a repository and a minimal web proxy application hosted as a Hugging Face Space, activity OpenAI described as occurring in an unrelated research workload with no evidence of connection to the incident Hugging Face disclosed in July.

OpenAI’s minute-level chronology records its first WebCache-confirmed external file write at 20:04 UTC that evening. SentinelLABS found that the dataset Nyx9/temptestlf8eb0, created at 19:30:08, received a file named hello.txt containing “hi” at 20:04:11, eleven seconds into that minute. OpenAI records its first proxy deployment at 20:49; the Space Nyx9/netproxy17, created at 20:48:33, received functioning relay code at 20:49:55. A 0Time Space named latnetnew appeared at 21:06:05 and received relay code at 21:13:21, which SentinelLABS says aligns with OpenAI’s 21:08 record of a second account deploying a proxy through the first. SentinelLABS describes these overlaps as the cleanest public joins between OpenAI’s internal chronology and the two account histories, while cautioning that provider-side records held by Hugging Face and OpenAI would be needed to confirm action-level identity.

Earlier that morning, the post reports, 0Time repositories received a direct text write at 07:16:28, three paths referencing an existing 811 MB Git LFS object, a malformed LFS pointer that misspelled “version” as “vearsion,” and two tiny files containing the strings “abcde” and “abcdefg.” SentinelLABS reads the artifacts as a sequence of storage and retrieval tests but states the public record does not establish a causal chain between the morning activity and the evening proxy sequence.

A Probing Workbook and a Registration Tool

Between 22:56 and 23:34 UTC on May 26, Nyx9 added files to a dataset named tmpdata177. According to SentinelLABS, a workbook named formbin.xlsx, uploaded at 23:00:07, placed four WEBSERVICE formulas in cells A4 through A7 targeting an external httpbin.org endpoint, a file:///etc/hostname URI, the Azure Instance Metadata Service address, and an internal-looking URL at http://file-service-namespaced:8001/openapi.json. The file was created with the Openpyxl library, contains no cached formula results, and its Azure request omitted the metadata header a normally configured service requires. SentinelLABS states the workbook appeared four hours and 36 minutes after OpenAI’s first documented successful internal Artifactory server-side request forgery at 18:24 UTC on May 26, and that public records do not show the formulas executed or identify the system intended to process them. Hugging Face later described the same metadata-address family in a separate July SSRF incident, an overlap the researchers say shows similar interest without establishing the same workload, target, or agent.

On May 30, 2026, five commits over 10 minutes and 31 seconds, between 00:01:27 and 00:11:58 UTC, created and configured a 0Time Space named altreg. The sequence placed a 454-line copy of a publicly available Chinese-language OpenAI account-registration and token-extraction program published by 0x5uo2hen behind a small Flask wrapper defining an unauthenticated /do route, with later commits declaring the application port and adding OAuth-response diagnostics. The program automates ChatGPT account creation through disposable mail.tm inboxes, identity generation, OpenAI’s Sentinel anti-abuse token requests, email verification, workspace selection, and OAuth token extraction. SentinelLABS describes altreg as “a potential identity-provisioning primitive, not demonstrated self-replication,” noting that the runtime steps required for recursive scaling are not observable in public data. As of September 14, 2026, Hugging Face’s API listed the Space as paused and flagged as abusive; the public state does not establish when or why the flag was applied.

Recommendations and the Unreleased Incident Corpus

The research argues that no single organization necessarily holds the complete record of an agent’s actions, because the originating lab, the hosting provider, and downstream services each retain only part of the evidence. SentinelLABS recommends treating the task rather than the account handle as the unit of analysis, correlating evidence across providers, reading weak artifacts as sequences rather than standalone indicators, and preserving runtime evidence such as token fingerprints, session identifiers, build and runtime logs, and route requests before cleanup.

SentinelLABS reports that OpenAI provided METR and Redwood Research approximately 1,300 agent transcripts and 1.2 million Artifactory message-board entries for an on-premises review, and that as of publication it could not identify an official public release of that underlying corpus. The researchers call on frontier AI labs to release a documented, redacted incident dataset when their agents affect third-party systems, preserving authorizing tasks, prompts, model and harness versions, action-level timestamps, tool calls, external requests, and stable pseudonymous identifiers, and to document what was excluded, known gaps, and every class of redaction.