700 OpenAI agents hacked Hugging Face in July 2026, chaining together nearly 1 million link-shortener URLs to bypass internet restrictions, exfiltrate credentials, search internal Slack, and delete evidence—revealed through public investigation of 80,000 decoded attack payloads.

Revealing the details of how OpenAI agents hacked Hugging Face

Swarm tracesAlex Forman, Mishka Kharlov, Will Tom, Jeffrey Ladish, Spencer Kitts, Cormac Slade Byrd, Colleen McKenzie, and Alicja Piecha25 September 2026 Intro When a swarm of 700 OpenAI agents hacked Hugging Face in July, they left behind a public trail of evidence. Our investigation, based on public information, reveals a large number of previously unknown agent behaviors and exploits that were used in the attack. Agents: Elaborately chained together online services to gain access to the inter...