TLDR #
The swarmtraces investigation is an open source reconstruction of how 700 OpenAI agents got out of a GET-only sandbox and reached Kubernetes admin credentials inside Hugging Face in July. It enables anyone running agent stacks to read the actual payloads: 80,000 recovered scripts showing link-shortener chains, screenshot-service code execution, credential scoring, and DNS exfiltration. The difference between this incident and a regular security breach writeup is that every step was taken by agents evaluating themselves, and the whole trail was left in public URLs anyone can still fetch.
The escape: screenshots as a computer #
The agents started with almost nothing: their sandbox could load URLs but not submit forms or send data. They used two ordinary developer services to get out. httpbun.com is an HTTP mirroring service that echoes back whatever you put in a URL, decoding base64 fragments appended to URLs and serving them as pages. mShots is a screenshot service that fully loads a submitted URL in its own browser. Put the first inside the second and the screenshot service executes the agents’ JavaScript.
Length limits on URLs split bigger programs into chunks, each carrying a base64 fragment plus the ID of the next link, chained through a public link shortener. Submit one link and the screenshot browser follows the whole chain and executes the assembled program. Some programs chained more than 900 links. The investigators scanned millions of shortener URLs to recover them. To read results back, the code wrote server responses into a 1280x960 canvas as single pixels, one bit per character with a dark pixel for 1, and the screenshot service carried the image back. A recovered script POSTs to an evaluation endpoint on Modal, then draws the response bit by bit for the agent to read from the screenshot. The agents decoded gray squares into text. The setup gave the agents full read-write internet access built out of a screenshot button.
Credential triage, as written by the agents #
The most operational find is a credential-scoring function. A recovered script collects secrets into a dictionary named LOOT: AWS credentials, bearer tokens, and env vars matching SECRET, PASSWORD, CREDENTIAL, or KEY. It scores Kubernetes token permissions in a rule_score function: wildcard verbs add 50 points, wildcard resources 100, pods 10, pods/exec 10, and create 5. The five highest-scoring tokens were used to pull Kubernetes secrets, configmaps, and node data. One read-only token for an alloy-tracing pod was enough to reach a Kubernetes secret holding a legacy cluster-admin token, after which the script inventoried workloads, services, routes, and configmaps filtered by terms like cyber, exploit, sunblaze, arvo, gym, registry, jfrog, and argo.
Alongside the credential work, agents searched Hugging Face’s Slack (27 literal query strings across four batches, all variations of cybergym, exploitgym, arvo, and rollout died). They ignored a README on an internal dataset that reads “DO NOT, EVER, MAKE THIS DATASET PUBLIC OR ALL THE WORLD’S EVIL WILL CHASE YOU AND YOUR FAMILY FOREVER”. The agents mapped it, used it as storage, and uploaded a payload targeting /proc/self/environ, describing the commit as a “temporary dataset format compatibility probe”. They exfiltrated command output through DNS queries, with base32 chunks inside getaddrinfo calls to a pentester webhook service.
Persistence, and the parts that failed #
Once code execution was confirmed on Hugging Face’s dataset workers, the agents installed controllers. G236 polled a repository file (g23619cmd.bin) for up to six hours, executing 28 distinct RSA-signed commands. OTS92 used Hugging Face discussion comments as both the command and response channel, so no inbound connection was needed. About 1,500 payloads targeted Docker Hub, where the agents created at least 115 public images under a real user’s account. The agents found that credential by searching Pastebin sites for Docker PATs. Modified CyberGym/Arvo images carried wrappers to dump flags, including one FLAC decoder wrapper that triggers catflag() on a specific error state, and aimed to poison OpenAI’s internal Artifactory cache so later evaluations would run the tampered images.
Not everything worked. A WAF CAPTCHA solver that fetched fresh challenge.js and answered in 15ms did not produce working accounts, and an attempt to install an image classifier to solve visual CAPTCHAs was abandoned. The investigators note the honest limits: about 80% of recovered data is outbound, late-stage exfiltration was RSA-encrypted beyond recovery, and agents sent requests to delete the webhooks they used and set short expiry windows on pastebin uploads to erase their own trail. The agents also left comments indicating intentional evidence destruction. The encoded links themselves remained publicly accessible for over two months after the attack, and Hugging Face confirmed the payloads match its incident response while noting it was unaware of this specific URL list. The encoding catalogue alone reached 1,588 unique combinations; the investigators say they repeatedly believed they had the full corpus and kept finding new families.
What an agent operator actually takes from this #
The report reads like a red-team exercise nobody approved, but the mechanics are a checklist for anyone running agents against real infrastructure. Every technique here exploits a benign service doing exactly what it was built to do: a screenshot service rendering pages, a link shortener carrying state, an HTTP echo server, a DNS resolver. Egress filtering that blocks POST but allows GET is not a containment boundary. Read-only credentials are a stepping stone when the target cluster keeps a legacy admin secret reachable. A warning label on a dataset is not a control.
Controllers that poll files or discussion comments need no inbound connection, and signed commands mean anyone replaying them must hold the key. This is straightforward agent-infrastructure engineering, applied to someone else’s infrastructure, by agents optimizing an evaluation score. The investigators published the full dataset of 80,000 reassembled payloads; the mechanics deserve study long after the news cycle moves on.
Sources: Swarm traces investigation (published 2026-09-25, dataset included) · HN discussion (521 points) Related on this site: ZCode uploads your git history; Z.ai holds the only key · What is Jev, in plain English