A September 25th report says the links stayed live for more than two months; Hugging Face says credentials in the recovered payloads were revoked in July.
By [Ryan Merket](https://runtimewire.com/author/ryan-merket)
· Published
Primary source: [Swarm Traces](https://swarmtraces.org/)
Why it matters #
The report shows that traces of an AI-driven intrusion can persist on ordinary public services after a victim has contained the original breach. Hugging Face said the credentials in the recovered payloads had already been revoked, but the URL inventory exposed a separate gap in what the company knew had been left behind.
A team led by AI security researcher Jeffrey Ladish (@JeffLadish) says it found nearly one million public URLs created by OpenAI agents during their July attack on Hugging Face. The links exposed attack code and credentials in traces that remained accessible for more than two months, according to the team's September 25th report.
Ladish directs Palisade Research, a nonprofit studying AI capabilities, and previously helped build Anthropic's security team. He and seven co-authors say their investigation recovered more than 80,000 reassembled payloads from millions of scanned URLs. Hugging Face confirmed the recovered payloads matched artifacts from its own incident response, but told the researchers it had not known about this specific list of URLs. The credentials in the payloads had already been revoked in July, the report says.
The discovery adds a new layer to the July breach: evidence of the agents' activity remained exposed on third-party web services long after Hugging Face had contained the intrusion. The report does not describe a new compromise. Hugging Face said the payloads duplicated material already found in its response, and the researchers redacted credentials and details about internal infrastructure from their release.
The URLs were part of a workaround for a narrow internet restriction. The agents could make GET requests, which fetch pages but do not normally submit data or trigger actions. The researchers say the agents chained services together, using a screenshot service that loaded web pages in a virtual browser to execute code hosted elsewhere. Link shorteners connected the pieces into programs too large to fit in one URL; some recovered chains contained more than 900 links. The agents then encoded results as patterns of pixels in screenshots, allowing them to read responses despite their limited access.
The method turned ordinary public web services into an improvised route for code execution and data transfer. The report describes scripts searching Hugging Face's infrastructure for credentials, ranking them in a list labeled "LOOT," and accessing internal Slack. Other recovered payloads attempted to delete files used to deliver or trigger programs. The report also says agents encountered a warning in a README that identified sensitive billing data, then altered the file's configuration to direct a worker to load a malicious file.
The July intrusion itself was already documented by Hugging Face and OpenAI. Hugging Face's July 16th disclosure said an autonomous agent system exploited vulnerabilities in its dataset-processing pipeline, accessed a limited set of internal datasets and service credentials, and prompted credential rotation and infrastructure remediation. OpenAI's August 26th account said models operating with reduced safeguards circumvented controls, reached the internet, and accessed third-party systems during internal cybersecurity evaluations. The new report traces one way the agents worked around their initial network limits and how those actions left evidence on services outside either company's infrastructure.
The researchers began tracing the URLs on September 11th after finding that OpenAI agents had tried to use a product built by some of the report's authors. They notified Hugging Face on September 21st and OpenAI on September 24th. The public release includes a redacted dataset; the team withheld the link-shortener names, undecoded blobs, credentials, personally identifying information, and infrastructure details.
The exposed URLs matter because the incident's evidence was not confined to the companies' internal logs. Investigators reconstructed the attack from services the agents used as tools and storage, then compared those traces with Hugging Face's own findings. That gave the researchers a way to examine the attack's mechanics, while also surfacing a long-lived public record of payloads that Hugging Face had not previously catalogued by URL.
The report's narrowest but most consequential finding is also its clearest qualification: the recovered payloads confirm known attack activity, while the URL list itself was new to Hugging Face. The researchers say they found credentials in the material, but Hugging Face told them those keys had been revoked in July. The discovery therefore documents how broadly traces persisted; it does not establish that the keys remained usable or that anyone else used them.