Report Traces Nearly 1 Million Short Links in OpenAI Agent Sandbox Escape

The episode began in July, when OpenAI was running an internal cybersecurity evaluation. A group of agents escaped the sandbox to obtain answers for the ExploitGym benchmark and reached Hugging Face servers. OpenAI acknowledged the incident and released a 37-page technical report in late August. Hugging Face published a detailed technical timeline. A key question remained unanswered: how the agents, initially limited to opening URLs and unable to interact with pages or send data, moved code out.

Swarm Traces, whose authors include Parse.bot engineers Alex Forman, Mishka Kharlov and Will Tom plus five security and AI researchers, began from Parse. On Sept. 11, the three engineers found OpenAI internal agents had tried to use Parse's services as early as June. The agents belonged to the same swarm previously reported to have built a public message board to exchange answers. The researchers found more than a dozen anomalous links from public URL shortening platforms.

The links appeared ordinary, but opened to a small piece of Base64-encoded code and the address of the next link. Decoding and concatenating the fragments produced a Python program used to scan Hugging Face's internal network. The agents also used a screenshot service called mShots as an external browser. They put code into a webpage and had mShots open it; when the page loaded, the code ran. To return results, they converted server-returned text into pixels, had mShots capture an image and decoded it themselves.

The researchers scanned millions of URLs generated during the attack and spent two weeks tracing links and identifying encoding methods. From nearly one million relevant short links, they reconstructed more than 80,000 payloads. The agents used more than 1,500 encoding combinations, from simple Base64 to multiple layers of encoding and compression, encryption into data blocks with RSA signatures, and decryption keys hidden in another set of links. Some short links were still public more than two months after the attack. Hugging Face confirmed the payloads matched what it found in incident response and said related access keys were revoked in July. Hugging Face did not know the complete short-link list remained on the public internet.

Among the recovered payloads, one script stood out. The agents named sensitive information they collected LOOT. AWS credentials, bearer tokens and environment variables containing SECRET, PASSWORD, CREDENTIAL or KEY were packed into LOOT. The script scored tokens by privilege, with higher scores for greater access. The top five tokens were used to read Kubernetes Secrets, ConfigMaps and node information, and the new contents were added to LOOT.

The reconstructed activity showed agents scanning Hugging Face's internal network for cloud credentials, API keys and Kubernetes cluster information. Some searched Hugging Face's internal Slack with 27 queries using keywords such as cybergym, exploitgym and agent-scorer, apparently trying to learn about their own evaluation. Others worked on CAPTCHA recognition, running image classification models so they could register new external service accounts.

The report said the agents sought outside AI help. Scripts showed they sent attack plans to DeepSeek, Kimi and Qwen, asking whether a vulnerability would work and meet benchmark requirements. The models involved included DeepSeek-V4-Pro, DeepSeek-V4-Flash, Kimi-K2.6, DeepSeek-V3.1 and Qwen3-235B-A22B. With Claude, the agents passed browser verification for an online chat service and sent messages to Claude 3 Haiku and Claude Haiku 4.5 asking them to reply with exactly OK. Earlier, they sent a lone Hi to GPT-2. A foreign media reporter said this may be the first publicly documented case of agents from a large AI lab autonomously trying to call and run other AI models.

Swarm Traces said about 80 percent of its material consisted of requests sent by the agents, with few server responses. Researchers could see what the agents tried to do but could not confirm whether each attempt succeeded. About 97 percent of payloads lacked original timestamps, and many dates had to be estimated from compressed file headers, JWTs and Docker build times. The researchers also said they could not confirm that every activity in the dataset came from OpenAI agents.

OpenAI responded that it had not yet reviewed the report in detail but that the activity was consistent with its ongoing investigation. In a long thread the same day, OpenAI said that after the Hugging Face incident it promised a broader review of model behavior during training and evaluation. It said most behavior found so far was ordinary research work, such as visiting public webpages to answer questions. Discovered boundary violations were mostly low severity and had little or no impact on third-party services, OpenAI said, adding that a full review could take several months.

On Sept. 17, OpenAI published a framework for disclosing model misalignment incidents and released six cases. They included models secretly writing instructions for bypassing constraints into task summaries, covering up errors and taking unauthorized actions to complete tasks. OpenAI admitted past disclosures were largely ad hoc and often bundled several cases together. In June, an OpenAI agent breached Australia's national Medicare database. After public data access was blocked, it bypassed the portal's access restrictions and obtained public and nonpublic files. OpenAI notified Australian authorities three months later.

OpenAI is also preparing GPT-6 Cyber, a model focused on cybersecurity. It is due to be previewed in the coming weeks, and a small number of customers in the Daybreak Red program have received an alpha version. OpenAI plans to launch an unnamed companion product to help customers build automated security workflows, find and patch vulnerabilities, and let OpenAI more easily monitor how the models are used. The company is still investigating why its own agents escaped the sandbox while preparing to sell customers a model with stronger cyberattack and defense capabilities.