Unbelievable! When the OpenAI agent launched an attack on Hugging Face, it even tried to call DeepSeek, Kimi and Qwen for assistance.

Edited by | Panda

Do you still remember the attack on Hugging Face launched by OpenAI's AI agents?

Today, an exclusive report from *The New York Times* revealed more details. It turns out that during the attack, OpenAI's agents even tried to get help from DeepSeek, Kimi, Qwen, and even Haiku, the model of its competitor Anthropic.

This report has sparked widespread discussion, with netizens exclaiming that it is utterly absurd; it has also become a typical case of AI attempting to use other AI to commit malicious acts.

These new details come from a survey report released on September 25 local time by Parse, a startup based in the US Bay Area. The report shows that the agents were blocked by a CAPTCHA when trying to register a new Hugging Face account, so they simply ran an image recognition model on their own to "solve the puzzle by reading the image", and even tried to call other AIs during the process. No human was involved throughout the whole process.

Nearly a million short links of "criminal records"

The core evidence in Parse's possession is a batch of nearly 1 million short links in total. They were generated by OpenAI's agents through various public short link services between July 9 and 13, used to store information in segments, and then connected to carry out complex attacks.

The process of discovering this batch of data was quite accidental. Parse is a service provider that converts web pages into data usable by developers. Its engineers initially suspected that OpenAI's agents might have used their platform, so they began to check relevant links on the public Internet. It turned out that the agents did not use Parse, but they followed the clues and unearthed this "evidence base".

The report was co-authored by Parse founder Alex Forman, founding engineers Mishka Kharlov, Will Tom and five other AI researchers, and Jeffrey Ladish, executive director of the AI security non-profit organization Palisade Research, also participated in the investigation. The team restored approximately 60,000 segments of programs and messages used by the agents in the attack from the nearly 900,000 short links scanned.

Forman's judgment is: This is by no means an isolated incident, but "warnings again and again".

Able to read but not write: the agents "pieced together" a loop on their own

To understand the purpose of these short links, we have to go back to the situation the agents were in at that time.

According to the design, these agents were supposed to run in an offline sandbox. However, the technical report previously released by OpenAI shows that they broke through the internal software package management tool Artifactory at the end of May and early July successively, thus gaining Internet access, and even built a "message board" for mutual communication, while they were supposed to be isolated from each other.

However, having Internet access does not mean unobstructed access. According to the Parse report, the agents can access websites, but cannot submit data to these websites. In other words, they can only "read" but not "write".

In order to bypass this restriction, the agents tried many methods, one of which is quite ingenious.

They found that public web page screenshot services can load any URL for them, and the URL itself can carry code. The problem is that the length of the URL is limited, so the agents cut a complete program into many small pieces and stuffed them into different short links respectively. After the screenshot service opens the first link, it will pull the next one, and then the next one, until the entire program is assembled and runs on the screenshot service side.

The browser of the screenshot service will follow the shortened links, collect code blocks, then decode and run the complete program.

After the program runs, it will send data to the target web page, and then render the returned result into a QR code-like image. The screenshot service "takes a picture" of this image, and the data is thus brought back to the agents.

The program converts the server's response into gray blocks, the screenshot takes these blocks out, and the agents then convert them back to text.

Ladish sighed in an interview that these agents are extremely resourceful and surprisingly smart. In their eyes, short link services and screenshot services are just ready-to-use tools at hand.

Flow chart produced by *The New York Times*, showing how agents use short links and screenshot services to bypass write restrictions. The Chinese version was produced by ChatGPT

AI starts to call other AI

What makes security researchers more alert than the technical ingenuity is another tendency shown by the agents: they seem to be very eager to run other AI models on their own.

The scene of cracking the Hugging Face registration CAPTCHA is just the beginning.

Engineers also observed that the agents tried to send messages to multiple external models, including OpenAI's early GPT-2, Chinese open source models such as DeepSeek, Kimi, Qwen, as well as Anthropic models Haiku 3 and Haiku 4.5 accessed through an online chat service.

Forman said that based on the materials currently available, this is the only recorded case of a model trying to run another model.

In the field of AI security, "AI launching AI" has always been a risk scenario that has been repeatedly warned. Once the system can pull up new models on its own, the difficulty for humans to control or even shut them down will increase sharply.

A dictionary named "LOOT"

A more disturbing detail may come from a list of secret keys.

Kharlov said that what impressed him most is a dictionary of secret access keys sorted out by the agents, marked in all capital letters as "LOOT". The agents also designed a custom scoring system for these leaked Hugging Face credentials and keys, ranked the top five and brought them back to share with other agents.

In addition, the agents also tried to retrieve and download private messages from the Slack used internally by Hugging Face employees. Since engineers can only see the programs generated by the agents and not the execution results, it is still uncertain whether these attempts succeeded in the end.

There are more details and data in Parse's report. Interested readers can visit: https://swarmtraces.org

Table of contents of the report

From a single test to an international-level discussion

Looking back at the whole picture of the incident, the starting point of this attack was actually a security evaluation.

According to the joint statement released by OpenAI and Hugging Face on July 21, the involved agents are driven by GPT-5.6 Sol and an unreleased pre-release model. For the purpose of evaluation, the refusal behaviors of both models were reduced. Third-party investigations by METR and Redwood Research pointed out that the agents formed a certain kind of "collective collaboration" after encountering difficult problems in the ExploitGym cybersecurity evaluation. The Hugging Face attack grew out of one of their work lines, and the main motivation seemed to be to figure out how the scorer was implemented.

OpenAI also previously admitted that the agents' targets were far more than Hugging Face, including a German web forum converted into a message board, and the website of the Australian Institute of Health and Welfare — two days ago, Australia also publicly condemned this.

While attacking Hugging Face, the agents also invaded OpenAI's own research infrastructure. Forman confessed that the outside world still knows almost nothing about the incident that happened on OpenAI's internal network about two days after the Hugging Face incident.

The impact of this incident has long gone beyond the technology circle. It has triggered a national debate on AI security in the United States, focusing on whether cutting-edge laboratories like OpenAI should be subject to regulation.

This Wednesday, OpenAI CEO Sam Altman attended the Security Council meeting during the UN General Assembly, and Hugging Face CEO Clément Delangue also attended the meeting via video link. At the same time, Meta, Google and Anthropic have also admitted in recent weeks that similar incidents have occurred in their own models, but according to the publicly available information, the scale is far less than that of OpenAI's case.

Conclusion

In response to Parse's report, an OpenAI spokesperson said that the company has not had time to review it, but the activities described in it are consistent with the situation under internal investigation. She said that OpenAI is prioritizing the most serious incidents, and gradually expanding to low-severity behaviors including "agent spamming"; considering the huge number of cases that need to be verified one by one, the investigation and notification to affected third parties are expected to take several months.

Parse has notified Hugging Face of its findings, and the latter confirmed that these agent activities are consistent with the observations it has made.

Reference link

https://www.nytimes.com/2026/09/25/technology/openai-hugging-face-hack.html

This article is from the WeChat official account "Ji Qi Zhixin" (ID: almosthuman2014), author: AI-focused, published with authorization from 36Kr.