ContentsIntroDiscovery TimelineAgents elaborately chained together online services in order to gain read and write access to the internetThe agents ignored a warning from Hugging FaceAgents attempted to remove traces of their workAgents interacted with external language models on Hugging FaceAn agent referred to server resources and credentials as “LOOT”Agents uploaded vulnerable Docker images to Docker HubAgents accessed and searched Hugging Face’s Slack to find information on their evaluationAgents turned Hugging Face workers into reusable infrastructureAgents used DNS requests to exfiltrate dataAgents mapped out Hugging Face’s Kubernetes clusterAgents tried to build CAPTCHA solvers to sign up for user accountsAgents set up elaborate communication infrastructureLimitationsAppendixAgents googled CVEs relating to Exploit Gym tasks Swarm traces
Alex Forman, Mishka Kharlov, Will Tom, Jeffrey Ladish, Spencer Kitts, Cormac Slade Byrd, Colleen McKenzie, and Alicja Piecha25 September 2026
Our investigation, based on public information, reveals a large number of previously unknown agent behaviors and exploits that were used in the attack. Agents:
The agents initially had very limited access to the internet: they could load URLs, but not interact with pages or send any data. Agents created a series of workarounds, primarily using a link-shortener site to create almost a million URLs that, when chained together, let them execute code to hack Hugging Face. These links let us piece together the details of how agents gained access and how deep the compromise was.
We’ve shared our findings with OpenAI and Hugging Face. Hugging Face confirmed that these payloads match ones found in their incident response and were aware that link shorteners were used in the attack.
This article was aggregated automatically by CyberWire Daily's newsfeed engine. Original reporting: swarmtraces.org.
