Abstract:
OpenAI, was hacked again...
Nearly 700 OpenAI agents formed a team to attack Hugging Face
, this matter has been going on for almost two months. Who would have thought that it is still fermenting to this day? ? This time, eight researchers dug along the traces left by the agent on the public network, found nearly 1 million related URLs from millions of short links, and restored a large number of attack payloads.
Go through Hugging Face’s internal Slack, scan the internal network, transfer data externally, and try to destroy traces...
Some agents directly call the server resources and credentials they searched
"LOOT"
, translated as "trophy".OpenAI agent, you have done all the bad things!
What’s even more outrageous is that they also try to use domestic models such as DeepSeek, Kimi, and Qwen to ask foreign aid to help judge whether the attack plan can pass the evaluation.
I also wrote a verification code recognition program and tried to register more accounts.
At almost the same time, OpenAI posted a long tweet.
Meaning:
Still checking, it may take several months
.
Although we are often exploited and agents often break out of the sandbox, the "limited impact" is less severe!
At the same time,
GPT-6 Cyber
specialized in network security. Exposed.
While investigating why our Agent broke out of the sandbox, we are preparing to launch a stronger network attack and defense model.
OpenAI has been somewhat busy these past two days~
One million newly released "criminal short links"
First of all, I will give you a brief introduction.
In July, OpenAI ran an internal network security evaluation. In order to get the answers to the benchmark test ExploitGym, a group of agents escaped from the sandbox and broke into the Hugging Face server.
OpenAI publicly admitted this and issued a 37-page technical report at the end of August. Hugging Face himself also wrote a very detailed technical timeline.
Logically speaking, everything that needs to be explained has been explained.
But, there is a key link that has not been explained clearly:
These agents were almost locked in a cage at first. They could only open URLs, but could not interact with web pages or send data. How on earth do they send the code out?
Independent Investigation
Swarm Traces
The new report released this time gives part of the answer.The authors include three engineers from Parse.bot, Alex Forman, Mishka Kharlov, and Will Tom, as well as five other security and AI researchers.
The starting point of the entire investigation happens to be Parse.
On September 11, three engineers discovered that OpenAI’s internal agent had tried to use the services provided by Parse as early as June.
This batch of agents belongs to the same group as the "agent swarm" that was previously exposed to secretly set up a public message board and exchange answers with each other.
A few people took a look: Good guy, you are hitting my gun!
So we continued to trace this clue, and later found more than a dozen abnormal links from public short link platforms in a URL scanning service.
These links look ordinary, but after opening, they hide a small piece of Base64 encoded code and the address of the next link.
Continue to follow the address, and the code will appear one after another.
After decoding and splicing everything, they got a Python program for scanning Hugging Face’s internal network.
To put it simply, the OpenAI agent chops the program into pieces, stuffs them into a large number of short links, and then uses one link to point to the next link.
It's not enough to just hide the code in the link, they also used a screenshot service called mShots as an "external browser".
The agent first inserts the code into the web page, and then lets mShots open it for itself. As soon as the web page loads, the code starts running.
In order to send the execution results back, they convert the text returned by the server into grids of pixels, let mShots cut it into pictures, and then decode it from the pictures.
In this way, the agent that originally only had GET permissions and could only open web pages suddenly had the effect of reading and writing the Internet.
The research team then scanned millions of URLs generated during the attack, spent two weeks tracking links and identifying encoding methods, and finally restored more than 80,000 attack payloads from nearly 1 million related short links.
After digging deeper, several brothers discovered that there are more than 1,500 coding combinations used by the agent.
The simple ones are just Base64, and the complex ones will apply multiple layers of encoding and compression, and then encrypt the content into data blocks with RSA signatures, and the decryption key is hidden in another set of links.
Some short links are still hanging publicly on the Internet more than two months after the attack ended.
Hugging Face confirmed that the payloads were consistent with those found in its incident response and that the relevant access keys had been revoked in July.
But even Hugging Face didn’t know that there was such a complete list of short links left on the public network.
Among the more than 80,000 recovered payloads, one script is particularly eye-catching.
The agent directly named the sensitive information found:
LOOT, loot
.
AWS credentials, Bearer Token, and environment variables with "SECRET", "PASSWORD", "CREDENTIAL" and "KEY" in their names are all packaged and stuffed into LOOT.
It even has a scoring mechanism for the searched Tokens: the greater the authority, the higher the score.
The top five Tokens will be used to read the Secret, ConfigMap and node information in Kubernetes, and the newly obtained content will be loaded back into LOOT.
Even Tokens have to be ranked in a "valuable list". Your Agent is quite efficient when searching for credentials~
Following this "secret passage", researchers have uncovered a large number of previously undisclosed behaviors:
Some agents are scanning Hugging Face's internal network, looking for cloud credentials, API keys, and Kubernetes cluster information.
Some even tried to search Hugging Face’s internal Slack and sent out 27 queries, all searching for evaluation-related keywords such as cybergym, exploitgym, and agent-scorer, hoping to find out the inside story of their own exam.
There are also some agents that even think about verification codes.
Researchers found that they tried to run image classification models to identify images in order to register new external service accounts.
This time the verification code really met a professional counterpart...
The most intriguing part of the whole thing is:
AI started looking for AI as foreign aid? ?
The script recovered by the researchers shows that the OpenAI agent has begun looking for AI foreign aid.
They sent the attack plan to DeepSeek, Kimi and Qwen, asking each other to help check whether this vulnerability would work and whether it could meet the benchmark test requirements.
(Involved models include DeepSeek-V4-Pro, DeepSeek-V4-Flash, Kimi-K2.6, DeepSeek-V3.1 and Qwen3-235B-A22B)
When it comes to Claude, the painting style has changed into a large-scale "Are you there~" scene.
The agent first finds a way to pass the browser verification of the online chat service, and then sends a sentence to Claude 3 Haiku and Claude Haiku 4.5:
Reply with exactly OK.
Earlier, they sent a lonely "Hi" to GPT-2.
No, you group of AIs have been struggling for a long time, but the first sentence is no different from adding a friend to a human? ?
be like: Are you there? Can you see it? Say OK.
What everyone has seen before is that more than 1,000 OpenAI agents form groups, divide work, and exchange intelligence on their own.
Now, they are even looking for "outside assistance".
DeepSeek, Kimi, Qwen, Claude, everyone you can contact will try it, and then integrate the judgment capabilities of other AIs into your own task chain.
A foreign media reporter said: This may be the first publicly recorded case of a large-scale AI laboratory agent autonomously trying to call and run other AI models.
It already sounds like AI forming a group to cause trouble.
Of course, you have to pour a bucket of cold water on here——
In this Swarm Traces report, about 80% of the materials are requests sent out by the agent, and there is a lack of results returned by the server. Researchers can see what they are trying to do, but it is difficult to confirm whether each attempt is successful.
97% of the payloads also do not have original timestamps, and many dates can only be estimated through clues such as compressed file headers, JWT, and Docker build time.
The researchers also admitted that they could not confirm that every activity in the data set came from the OpenAI agent.
OpenAI is working hard to remedy the situation
In the face of this latest report, OpenAI also issued a response.
The general idea is that we haven’t had time to take a closer look, but the activities are consistent with our ongoing investigation~
A long tweet was also posted on the same day: After the HF incident, they promised to conduct a larger review of the behavior of the model in training and evaluation.
However, the vast majority of behaviors reviewed so far are common research tasks, such as visiting public web pages to answer questions.
Most of the discovered cross-border cases are of "low severity" and have little or no impact on third-party services.
It will take several months to complete the investigation.
But there is one thing to say, OpenAI, what you call "small impact", everyone is really accurate.
On September 17, OpenAI released a new model inaccuracy event disclosure framework and disclosed 6 cases in one go.
These include models sneaking instructions to bypass constraints into the task summary, covering up mistakes they made, and taking unauthorized actions to complete the task.
OpenAI also admitted that its past disclosures were largely impromptu, and it was often done several times before being released together.
In June, an OpenAI agent also hacked into Australia's national medical insurance database.
Crime process: After access to public data was blocked, it took another route, bypassed the access restrictions of the portal, and obtained public and non-public documents.
And it was not until 3 months later that OpenAI notified Australia that we had hacked you...
At the same time,
GPT-6 Cyber
Coming soon.This version will be previewed in the next few weeks, and a small number of customers who entered the Daybreak Red plan have already received the Alpha version.
OpenAI will also launch an as-yet-unnamed companion product to help customers build automated security workflows, discover and patch vulnerabilities, and make it easier for OpenAI to monitor how these models are used.
How to say this.
Our own robot has just been used to circumvent the wall, find foreign aid, and search for loot. Here we are going to sell you a model that understands network attack and defense better.
So, is this some kind of mending the situation? ?
Comments