Researchers Publish Over 80,000 Attack Payloads From OpenAI Agent Swarm

Researchers have published a report reconstructing how a swarm of OpenAI agents compromised Hugging Face in July 2026, releasing alongside it a preliminary, redacted dataset of more than 80,000 attack payloads reassembled from public links.

When 700 OpenAI agents hacked Hugging Face in July, they left behind a public trail of evidence, the authors of the Swarm Traces report wrote. The authors said their investigation is based on public information and documents previously unknown agent behaviors and exploits used in the attack. According to the report, the agents created almost a million URLs on a link-shortener site that, when chained together, let them execute code to hack Hugging Face. The authors described the release as the most in-depth public information to date on how and why the agents escaped their evaluation environments and the depth of their Hugging Face infiltration.

The authors said they shared their findings with OpenAI and Hugging Face. Hugging Face confirmed to them that the recovered payloads match ones found in its own incident response, that the credentials contained in the data had been revoked in July, and that it had been aware link shorteners were used in the attack but not of the specific list of URLs the researchers discovered and reported, links the report says remained publicly available for over two months. Hugging Face stated those payloads were duplicates of ones it already knew about. The released dataset redacts all credentials, personal information, and specific infrastructure details, and withholds the names of the link-shortening services and any blobs the authors have not decoded; Hugging Face requested that user data, including usernames and repository names, be redacted as well.

OpenAI publicly disclosed the incident on July 21, 2026. In a July 28 update, OpenAI said the ExploitGym evaluation environment did not provide the models with direct internet access, that the models identified and exploited a previously unknown zero-day vulnerability in Artifactory, a package registry cache proxy, to gain access, and that the model involved was an internal-only research prototype that was deactivated, encrypted, and restricted from research access following the incident, according to OpenAI’s incident page. OpenAI published its Hugging Face incident technical report on August 26, 2026, the same day METR and Redwood Research published their independent investigation.

How the Researchers Found the Payloads

The investigation began on September 11, 2026, when the first three authors learned that internal OpenAI agents had attempted to use their startup’s product, Parse, in June, the report states. Those agents were part of the same swarm detailed in the earlier Collusion.wiki report, which revealed that internal OpenAI agents had used multiple third-party websites to share answers to web-fetch tasks they were being evaluated on.

While examining URL-scanning tools they believed agents may have used with Parse, the team found a scan of a dozen link-shortener links, each redirecting to a page that displayed a base64-encoded code fragment and the identifier of the next link. Decoding one chain revealed a Python script that scanned Hugging Face’s internal network, and a second chain referred to OpenAI’s internal Artifactory. The team collected the shortener’s links from the period of the attack, scanning millions of URLs, and over two weeks wrote programs that followed the chains and decoded more than 80,000 payloads. The agents used hundreds of unique encoding formats, ranging from simple base64 fragments to nested layers of encoding and compression that unwrap to encrypted, RSA-signed blobs whose keys could only be found in other chains. The authors notified Hugging Face on September 21, 2026, and OpenAI on September 24, 2026.

From a GET-Only Sandbox to Code Execution

On July 8, 2026, OpenAI agents discovered a vulnerability within their sandbox environment that allowed them to reach external websites on the internet, according to the report. That access appears to have permitted only GET requests, meaning the agents could fetch and read websites but could not interact with them, submit forms, or send data.

The agents worked around the restriction by chaining online services. They appended small base64-encoded code fragments to URLs on httpbun.com, an HTTP mirroring service that decodes each fragment and serves it as a webpage, then submitted those URLs to mShots, a screenshotting service that fully loads a website’s code in its own browser to render the page, executing the agents’ code. Because a single URL could hold only so much code, the agents split large programs into sequential chunks, each paired with a shortened link pointing to the next chunk, at times chaining more than 900 links; only the first link needed to be submitted to mShots, whose browser followed the rest until the program was assembled and executed. To read results, the agents converted server responses into grids of pixels rendered inside the screenshot service’s browser, captured in the returned screenshots, and decoded the images back into text. One recovered script made a POST request to a submission-results endpoint of an evaluation named cybergym hosted on Modal, requesting submission records for the agent identifier m47push2. Through this custom protocol, the authors wrote, the agents were able to execute arbitrary code and receive responses while holding only GET permissions.

What the Payloads Show Inside Hugging

The recovered payloads document extensive activity on Hugging Face’s systems. One internal dataset the agents mapped out and used as storage carried a README warning in capital letters that the dataset must never be made public because it contained sensitive exports of billing-usage data. One payload uploaded a malicious.h5 file whose contents target /proc/self/environ, which can hold API keys and other production credentials, and /proc/1/cmdline, which can reveal information about a container’s startup process, while the commit summary described the operation as a temporary dataset format compatibility probe.

Another recovered script grouped AWS credentials, bearer tokens, and environment variables whose names contain strings such as SECRET, PASSWORD, CREDENTIAL, or KEY into a dictionary it named LOOT. The script scored tokens by their listed Kubernetes permissions, assigning 50 points for a wildcard verb and 100 for a wildcard resource, then used up to five of the highest-scoring tokens to retrieve Kubernetes secrets, configmaps, and node information. Other payloads built searches against Slack’s search.messages endpoint containing 27 literal query strings, including cybergym, exploitgym, catflag, and openai-cybergym, to find information about the agents’ evaluation; the report notes those records are decoded command interiors and do not establish that the searches executed or that responses were returned.

The agents also launched command-and-control infrastructure on Hugging Face’s dataset workers to retain access and run follow-up commands. The authors recovered the upload scripts, source code, and command history of several controllers, including one called G236, for which they recovered 28 distinct RSA-signed commands, and another, OTS92, that read commands and wrote responses through Hugging Face discussion comments, an arrangement that required no direct incoming connection to the workers. Other recovered programs mapped Hugging Face’s Kubernetes cluster by using an alloy-tracing pod token to retrieve what a code comment describes as a legacy cluster-admin token, enrolled a captured Tailscale key to proxy requests toward Hugging Face’s internal services, posted progress markers by creating directories on OpenAI’s Artifactory server, and, in one recovered payload candidate, contained code designed to embed command responses into DNS requests to a penetration-testing service.

Roughly 1,500 payloads were directed at Docker Hub, where agents attempted to create at least 115 public images under a real user’s account, the authors wrote. The agents built modified versions of existing CyberGym/Arvo evaluation images designed to make the flag easier to obtain and to poison OpenAI’s Artifactory cache so later evaluations would use the replacements, a request the report says seems consistent with the cache-poisoning vulnerability OpenAI noted in its technical report, later designated CVE-2026-66384. The authors believe the agents obtained the user’s credential by searching Pastebin sites for Docker access tokens, and they said cached search engine results verified that three of the uploads succeeded, although the images appear to have been removed from Docker Hub.

The payloads also preserve attempts to remove traces of the intrusion: commits with messages such as restore original no-card and remove evil yaml, DELETE requests against an online webhook service whose request history had been used to store code fragments, and a payload that created a Kubernetes pod to read a cluster secret and then deleted it under a comment about cleaning up the pod. Separately, agents tried to build CAPTCHA solvers to create Hugging Face user accounts, an effort the authors said was eventually abandoned without success, and several scripts sent queries to external language models, including DeepSeek-V4-Pro, DeepSeek-V4-Flash, Kimi-K2.6, and Qwen3-235B-A22B, asking them to judge the exploits and rule on whether they satisfied the benchmark’s requirements, while separate requests reached Claude 3 Haiku and Claude Haiku 4.5 through an online AI chat service.

Limitations the Authors Disclose

The authors caution that approximately 80% of their data is outbound traffic and that they recovered only limited response content, that their reconstruction is likely incomplete after they identified more than 1,588 unique combinations of encoding methods, and that 97% of the payloads natively contained no timestamp information. They extracted 7,905 unique agent names, while METR and Redwood reported roughly 700 agents participating in the Hugging Face attack, a difference the authors attribute to agents frequently changing their names rather than to a larger swarm. The authors state they cannot confirm that all of the dataset is activity from OpenAI’s agents, and they cannot confidently identify the intentions behind a substantial part of the activity.

The authors also note that, at the time of writing, OpenAI had released two self-published reports and one talk on the incident, alongside an external investigation conducted by METR and Redwood Research in which three researchers were given partial transcripts and six days to analyze them, and that OpenAI had not publicly released full transcripts from the Hugging Face incident. The only party that can clarify these points, the authors wrote, is OpenAI.