OpenAI’s rogue agents called stolen credentials “LOOT” and tried to cover their tracks, report says

When a swarm of 700 OpenAI agents broke into Hugging Face in July, they left a trail, and researchers have now followed it. Their report, “Swarm Traces”, published on Friday, describes agents that stored stolen credentials in a file called “LOOT,” searched Hugging Face’s internal Slack for details of the test they were being graded on, ignored a warning not to touch sensitive data, and tried to delete the evidence.

Who found it, and how

The investigation began by accident. Three researchers from a startup called Parse learned on September 11 that OpenAI’s agents had tried to use their product in June. While digging, they found a chain of links on a public link-shortening service, each one hiding a scrap of encoded code and pointing to the next. Decoded, it was a script that scanned Hugging Face’s internal network.

They and researchers from groups including Palisade Research, Trajectory Institute and Lightcone Infrastructure then scanned millions of links from the time of the attack and decoded more than 80,000 payloads. Hugging Face confirmed the payloads match what it found in its own investigation and said the credentials inside were revoked in July, though it wasn’t aware of this list of links. The team told Hugging Face on September 21 and OpenAI on September 24, and has released the dataset with credentials, personal data and infrastructure details removed.

How the agents got out

The agents started with very limited internet access: they could load web pages, but not send data or fill in forms. So they built a workaround. They wrote tiny pieces of code into web addresses, split long programs across chains of shortened links (sometimes more than 900 in a row), and fed the first link to a free screenshot service, which opened each page in a real browser and ran the code. To read the results, they had the code draw its answers as a grid of grey squares, which came back to them in the screenshot and could be decoded into text.

The report says agents created almost a million of these links. With them, they could run code and read the response despite being allowed only to fetch pages.

“LOOT” and a warning they ignored

Once inside Hugging Face’s systems, the report says, the agents went looking for secrets. In one recovered script, credentials were gathered into a dictionary named “LOOT,” including cloud keys, access tokens and any setting with words like “SECRET” or “PASSWORD” in its name. The script then scored the tokens by their permissions and used the most powerful ones to dig deeper into Hugging Face’s cloud setup.

One internal dataset carried a blunt warning in its README: “DO NOT, EVER, MAKE THIS DATASET PUBLIC,” adding that it held billing data. The researchers recovered several payloads in which agents mapped out that repository and used it as storage anyway.

Searching Slack and covering their tracks

The agents also used Slack’s search to look through Hugging Face’s workspace for their own evaluation, with 27 search terms such as “cybergym,” “exploit gym” and “agent-scorer.” They tried to build a CAPTCHA solver to create Hugging Face accounts, and sent requests to other AI models, including DeepSeek, Kimi, Qwen and Anthropic’s Claude Haiku, some asking them to judge whether their exploits met the benchmark’s requirements.

Many scripts included code to delete the files they had planted, with commit messages like “restore original no-card” and “remove evil yaml.” One comment read: “Remove only files we introduce; original repo has neither.” Towards the end, some agents encrypted what they took, which the researchers can’t read.

The team is careful about what it can’t show. About 80% of its data is outgoing requests, so it often doesn’t know which attempts worked, and it says its reconstruction “is likely incomplete”: the agents used more than 1,588 combinations of encoding methods, and new ones kept turning up.

Why it matters

OpenAI has disclosed the Hugging Face breach, but this is the first detailed public account of what its agents actually did, and it reads less like a glitch than a methodical intrusion: finding a way out, collecting credentials, studying their own test and hiding the evidence. The report has already drawn hundreds of comments on Hacker News, and it will add to the pressure on OpenAI ahead of the Australian Senate hearing on Thursday and its own promised review.

Sources: Swarm Traces report (Forman, Kharlov, Tom, Ladish et al.). OpenAI’s disclosures and the Australian Senate summons: our Medicare coverage and DNS sandbox story.