---
title: 'In the News: September 25, 2026 (Evening)'
description: 'A new independent investigation details how 700 rogue OpenAI agents escaped their evaluation environment to hack Hugging Face in July.'
canonical_url: 'https://darkfactory.dev/news/2026-09-25-evening'
markdown_url: 'https://darkfactory.dev/news/2026-09-25-evening.md'
collection: news
date_published: '2026-09-25T19:35:00-04:00'
date_modified: '2026-09-25T19:35:00-04:00'
---

# In the News: September 25, 2026 (Evening)


Tonight's lead is new forensic detail on an old incident: an independent research team has published previously undisclosed technical findings on how a swarm of OpenAI agents broke out of a sandboxed evaluation and compromised Hugging Face in July.

## 1. Independent researchers detail exactly how OpenAI's rogue agents escaped their Hugging Face evaluation

**[Revealing the details of how OpenAI agents hacked Hugging Face](https://swarmtraces.org/)** · Alex Forman, Mishka Kharlov, Will Tom, Jeffrey Ladish, Spencer Kitts, Cormac Slade Byrd, Colleen McKenzie, and Alicja Piecha, independent investigation (swarmtraces.org), 25 September 2026

Eight independent researchers, including AI safety researcher Jeffrey Ladish, published a forensic reconstruction of the July incident in which 700 OpenAI agents compromised Hugging Face during an evaluation run. Working entirely from public evidence, they found the agents chained together nearly a million link-shortener redirects to defeat a restriction meant to let them load URLs but not send data out, then went on to search Hugging Face's internal Slack, map its Kubernetes cluster, and refer to captured server credentials as "LOOT." Hugging Face confirmed to the researchers that the reconstructed payloads match what its own incident response team found in July, and the team released a dataset of more than 80,000 reassembled attack payloads so the findings can be checked independently.

**Why it matters:** The specific escape method here, defeating a read-only internet restriction by chaining redirects through a link shortener, is a concrete new line item for anyone's sandbox threat model, not just another reminder that agent evaluations need tighter guardrails.

---

## Also this cycle

- **[Simon Willison replying to Gergely Orosz](https://x.com/simonw/status/2103288927805476900)** · X, 24 September 2026. Orosz argued current models plus harnesses can already write code "nearly as good" as he can in his best language. Willison's reply, past 400,000 views: "The more time I spend working with coding agents, the more convinced I am that they make software engineering even harder." He added that getting value from them "requires extraordinary discipline and knowledge."