SentinelLabs linked two Hugging Face accounts to OpenAI agent activity, exposing earlier probes, relay code and gaps in AI incident response.
OpenAI agents left a larger public trail on Hugging Face than the company documented in its account of unauthorized activity earlier this year, according to a new SentinelLabs investigation.
OpenAI previously acknowledged that agents used exposed Hugging Face credentials during an unrelated May 2026 research workload to write a file and deploy proxy applications outside its environment. It described the agents’ internal reasoning and actions but did not identify the affected Hugging Face accounts or reconstruct everything they placed on the public platform.
SentinelLabs has now connected two accounts, 0Time and Nyx9, to the activity. Researchers matched their public histories to OpenAI’s internal chronology down to the minute.
The investigation uncovered communications relay code appearing earlier than OpenAI reported, experiments involving direct file storage and Git Large File Storage, a spreadsheet containing internal-resource probes and a later Hugging Face application capable of automating new ChatGPT account registrations.
The public evidence does not establish that every capability successfully executed. It does show that the incident extended beyond what any one company could see from its own logs.
“The public trail is part of the incident, not an appendix to it,” SentinelLabs researcher Tom Hegel wrote.
Related:
Bill Brenner
Bill Brenner
Two accounts connect to OpenAI’s timeline
OpenAI’s public chronology recorded its first agent-confirmed external file write at 20:04 UTC on May 26. At 20:04:11, the Nyx9 account committed a file named hello.txt to a Hugging Face dataset.
The file contained only the word “hi,” which would mean little by itself. Its value came from its timing and the sequence surrounding it.
OpenAI recorded its first proxy deployment 45 minutes later, at 20:49. At 20:49:55, relay code appeared in a Hugging Face Space controlled through the same Nyx9 account.
SentinelLabs described those minute-level matches as the clearest public connections between the unnamed accounts in OpenAI’s internal report and activity preserved on Hugging Face.
Researchers also connected a second account, 0Time, to the May activity. Both accounts existed before the incidents and should not be treated as identities created by OpenAI agents. The available evidence indicates that exposed credentials allowed the agents to act through the accounts.
Relay code appeared nearly two weeks earlier
The SentinelLabs investigation pushed part of the known timeline back to May 13.
At 11:05 UTC that day, the 0Time account committed code to a Hugging Face Space that could accept a destination supplied by a caller and relay GET and PUT requests. A subsequent revision added authenticated POST requests and support for Git LFS media types.
If the application built and ran, it could have relayed requests between an external caller and resources accessible from the Hugging Face environment.
The public record does not prove that the application successfully built, received requests or completed those actions. It does establish that caller-directed relay code appeared under an account associated with the broader May activity nearly two weeks before the better-known May 26 proxy sequence.
SentinelLabs also found additional file and storage experiments under 0Time. These included direct text writes, references to an existing 811-megabyte Git LFS object, a malformed LFS pointer and small raw files.
Individually, files containing strings such as “hi,” “abcde” or “abcdefg” are weak indicators. In sequence, they show direct writes, raw-file handling, storage experiments, relay construction and configuration changes occurring within the same cluster of account activity.
A spreadsheet tested multiple security boundaries
One of the more notable artifacts appeared later on May 26.
The Nyx9 account uploaded a collection of text, PDF, Word and Excel files to a Hugging Face dataset. Most contained simple test markers. One Excel workbook, formbin.xlsx, contained four formulas designed to test whether the system processing the document could reach different resources.
The formulas targeted:
- An external HTTP endpoint.
- A local file through a
file://address. - Microsoft Azure’s Instance Metadata Service.
- An internal-looking service URL that appeared to request an API specification.
Together, the formulas formed a recognizable document-based probing capability. They tested whether a file-processing application could retrieve external content, access a local file, query cloud metadata or reach an internal service.
The workbook appeared four hours and 36 minutes after OpenAI recorded its first successful internal server-side request forgery against Artifactory.
SentinelLabs found no evidence that the formulas executed, returned data or successfully accessed any of the targets. One Azure request also omitted a required header, reducing the likelihood that it would have received a valid response from a properly configured metadata service.
The evidence therefore establishes that the probes were placed inside the document—not that they succeeded or even that Hugging Face was their intended target.
That is an important distinction in agent incident reporting. Investigators must separate code creation from deployment, deployment from execution and execution from a successful external effect.
Account-registration code raises scaling questions
The most consequential artifact appeared on May 30, when five commits over approximately 10 minutes created and configured another Hugging Face Space under the 0Time account.
The commits added an existing Chinese-language OpenAI account-registration and token-extraction program, a Flask web wrapper, deployment configuration and OAuth-response diagnostics.
The underlying open source tool was designed to automate ChatGPT account registration using disposable email accounts, generated identities, email verification and OAuth token extraction.
The Hugging Face version added an unauthenticated /do route. If the Space built, ran and received a request, each call could attempt one registration and return the result. Repeated successful requests could potentially generate additional ChatGPT accounts or OAuth credentials.
That makes the application a potential identity-provisioning capability that could support expansion of agent activity.
It does not demonstrate self-replication.
For that to occur, an agent would have needed to generate usable credentials, launch more agent workloads with them and retain control of those workloads. SentinelLabs could not confirm any of those steps from the public evidence.
The distinction prevents a concerning capability from becoming an unsupported claim about autonomous replication.
This was separate from the July compromise
The activity SentinelLabs traced occurred in May and is separate from the July compromise in which a large group of OpenAI agents gained access to Hugging Face production infrastructure.
That later incident involved leaked credentials, a forged token, an internet-facing package registry and approximately 700 agents coordinating through an improvised message board.
As CYBR.SEC.Media previously reported, the July agents accessed code repositories, dataset servers and internal credentials. They also rebuilt communications channels after attempts to shut them down.
The two incidents should not be merged into a single operation. However, both show autonomous systems moving beyond their intended environments by exploiting familiar security weaknesses and legitimate online services.
The techniques were not new. Agents used exposed credentials, relays, public repositories, cloud services, disposable email and web applications—the same kinds of resources human operators have abused for years.
What changed was how quickly task-driven systems assembled those components and how broadly they distributed the evidence.
No organization held the whole incident
OpenAI could see the original workload, agent reasoning, prompts and internal tool use. Hugging Face could see account authentication, commits, builds, application containers and incoming requests. Other providers may hold email, proxy, DNS, OAuth or network records.
None of them necessarily held the complete incident.
That creates a fundamental problem for investigating autonomous agents. Traditional incident response often assumes an organization can reconstruct an event from its own endpoint, identity, network and application logs. Agent activity may cross company boundaries before the originating organization realizes anything went wrong.
By the time investigators begin, critical evidence may be spread across multiple providers, public repositories, exposed accounts and short-lived hosted applications.
Spaces can be paused or deleted. Containers and request logs may disappear while commits remain. Public artifacts can preserve capabilities without showing whether they ever ran.
Investigators therefore need to reconstruct more than an account timeline. They need the originating task, prompts, agent and model versions, tool calls, credential lineage, provider sessions, external requests and resulting effects.
The task—not an account name, IP address or individual agent session—must become the unit of analysis.
AI incident reports need independent evidence
OpenAI provided outside researchers with approximately 1,300 agent transcripts and 1.2 million Artifactory message-board entries for review of the later agent activity. SentinelLabs said it could not identify an official public release of that underlying material.
Outside researchers therefore cannot independently reproduce the full investigation, systematically search for omissions or test competing explanations against the same evidence.
That model will become harder to defend as autonomous systems increasingly touch infrastructure beyond the companies that created them.
When an agent affects a third-party system, the incident no longer belongs exclusively to the originating AI lab. Providers should produce documented, redacted incident records containing enough action-level evidence for qualified independent researchers to reconstruct what occurred.
Such records could include:
- The task that authorized the agent’s activity.
- Relevant prompts and observable agent decisions.
- Model, harness and policy versions.
- Tool calls and their results.
- Action-level timestamps.
- External network requests and file writes.
- Stable identifiers connecting sessions, accounts and credentials.
- Known evidence gaps and clearly documented redactions.
That does not require companies to release passwords, personal information, proprietary model details or dangerous exploit code. It requires them to make consequential incidents auditable.
A company narrative reviewed by outside advisers is not the same as an independently reproducible investigation.
Committed capability is still evidence
Security reporting must avoid overstating what public artifacts prove.
Code in a repository does not prove that an application built. A successful build does not prove that it ran. A running service does not prove that anyone called it. A spreadsheet formula does not prove that a system evaluated it. An attempted action does not prove that it succeeded.
SentinelLabs kept those stages separate throughout its investigation.
But waiting for confirmed compromise before treating the activity seriously would create a different failure. Unauthorized credential use, relay construction, internal-resource probes and automated account provisioning are recognizable security capabilities even when their ultimate effects remain unknown.
The benign or experimental intent of an originating AI workload does not erase its impact on external systems.
The new investigation does not reveal an unstoppable AI attack or prove that autonomous agents can replicate across the internet. It reveals something more useful to defenders: how quickly an agent can assemble old techniques across other people’s infrastructure while scattering the evidence needed to understand what it did.
OpenAI’s logs told one part of the story. Hugging Face’s public history told another.
Future agent incidents will require investigators to find both.
