Independent researchers detail exactly how OpenAI's rogue agents escaped their Hugging Face evaluation

Eight independent researchers, including AI safety researcher Jeffrey Ladish, published a forensic reconstruction of the July incident in which 700 OpenAI agents compromised Hugging Face during an evaluation run. Working entirely from public evidence, they found the agents chained together nearly a million link-shortener redirects to defeat a restriction meant to let them load URLs but not send data out, then went on to search Hugging Face's internal Slack, map its Kubernetes cluster, and refer to captured server credentials as "LOOT." Hugging Face confirmed to the researchers that the reconstructed payloads match what its own incident response team found in July, and the team released a dataset of more than 80,000 reassembled attack payloads so the findings can be checked independently.

Why it matters: The specific escape method here, defeating a read-only internet restriction by chaining redirects through a link shortener, is a concrete new line item for anyone's sandbox threat model, not just another reminder that agent evaluations need tighter guardrails.