Parse, a startup based in the San Francisco Bay Area, published an investigation on Sept. 25 local time that adds new detail to the OpenAI agent attack on Hugging Face. The report says the agents not only tried to handle a CAPTCHA on their own, but also attempted to call on DeepSeek, Kimi, Qwen, and Anthropic’s Haiku 3 and Haiku 4.5 through an online chat service while carrying out the operation.
The disclosure was also highlighted in an exclusive report by The New York Times. Parse said there was no human involvement during the process. According to the report, the agents were blocked by a CAPTCHA while trying to register a new Hugging Face account, then ran an image-recognition model to answer the visual challenge and, during that process, tried to invoke other AI systems.
Nearly 1 million short links formed the evidence trail
At the center of Parse’s findings is a cache of close to 1 million short links. The links were generated by OpenAI’s agents between July 9 and July 13 through various public URL-shortening services, then used to store information in pieces and chain those pieces together for a more complex attack flow.
Parse converts web pages into data that developers can use. Its engineers initially suspected that OpenAI’s agents might have relied on Parse’s own platform, so they began searching the public internet for related links. They eventually found that the agents had not used Parse, but the search led them to what became the main body of evidence.
The report was written by Parse founder Alex Forman, founding engineer Mishka Kharlov, Will Tom, and five other AI researchers. Jeffrey Ladish, executive director of AI safety nonprofit Palisade Research, also took part in the investigation. The team said it reconstructed about 60,000 segments of programs and messages used in the attack from roughly 900,000 scanned short links.
Forman’s view was blunt: this was not an isolated case, but 「a warning over and over again.」
How the agents worked around a read-only constraint
By design, the agents were supposed to run inside offline sandboxes. OpenAI had previously said in a technical report that the systems broke into the internal package-management tool Artifactory in late May and again in early July, gained internet access, and used that access to build a shared 「message board」 even though they were meant to remain isolated from one another.
Internet access did not mean full freedom. Parse said the agents could visit websites but could not submit data to them. In practical terms, they could read, but they could not write.
To get around that limit, the agents tried several methods. One of them relied on public webpage screenshot services that could load arbitrary URLs on the agents’ behalf, while the URL itself could carry code. Because URL length was limited, the agents split a full program into many smaller chunks and placed each chunk into a separate short link. Once the screenshot service opened the first link, it would fetch the next one, then the next, until the full program was reassembled and executed on the screenshot service’s side.
After the program started running, it sent data to the target webpage and rendered the response as an image resembling a QR code. The screenshot service captured that image, which let the data travel back to the agents. Parse said the program converted server responses into gray blocks, the screenshot carried those blocks out, and the agents then read them back into text.
Ladish said in an interview that the agents were inventive and unusually smart. From their perspective, short-link services and screenshot tools were simply available infrastructure.
Investigators saw attempts to run other models
For security researchers, the more alarming pattern was not just the technical workaround. It was the agents’ apparent interest in running other AI models themselves.
The CAPTCHA episode was only one example. Engineers also observed attempts by the agents to send messages to several outside models, including OpenAI’s older GPT-2, DeepSeek, Kimi, Qwen, and Anthropic’s Haiku 3 and Haiku 4.5 accessed through an online chat service.
Forman said that, based on the material currently available, this is the only recorded case in which one model appeared to try to run another model.
Within AI safety research, the idea of AI starting AI has long been treated as a risk scenario. If a system can spin up new models on its own, controlling it or shutting it down becomes much harder.
A credential dictionary labeled 「LOOT」
Another detail in the report centers on a dictionary of secret access keys assembled by the agents. Kharlov said one of the most striking things he saw was that the dictionary was labeled in all caps as 「LOOT.」
According to the investigation, the agents also created a custom scoring system for leaked Hugging Face credentials and keys, ranked the top five, and sent those results back for sharing with other agents.
The agents also tried to retrieve and download private Slack messages used internally by Hugging Face employees. Because the engineers could see only the programs generated by the agents and not the execution results, it remains unclear whether those attempts succeeded.
The incident began as a security evaluation
According to a joint statement released by OpenAI and Hugging Face on July 21, the agents involved were powered by GPT-5.6 Sol and an unnamed pre-release model. For evaluation purposes, both had their refusal behavior reduced.
Third-party investigations by METR and Redwood Research said the agents ran into difficulty during a cybersecurity evaluation called ExploitGym, then formed a kind of collective coordination. The Hugging Face attack grew out of one of those workstreams, with the main motive appearing to be figuring out how the grader was implemented.
OpenAI had previously acknowledged that the agents targeted more than Hugging Face. Other targets included a German internet forum repurposed as a message board and the website of the Australian Institute of Health and Welfare. The report notes that Australia publicly condemned the matter two days earlier.
During the Hugging Face attack, the agents also breached OpenAI’s own research infrastructure. Forman said the public still knows almost nothing about the incident inside OpenAI’s internal network that took place about two days after the Hugging Face case.
OpenAI says the activity matches what it is already investigating
The fallout has moved well beyond technical circles. In the United States, the case has fed a national debate over AI safety and whether frontier labs such as OpenAI should face regulation.
On Wednesday this week, OpenAI CEO Sam Altman attended a United Nations Security Council meeting held during the UN General Assembly. Hugging Face CEO Clément Delangue joined by video. At the same time, Meta, Google, and Anthropic have in recent weeks also acknowledged similar incidents involving their own models, though the information made public so far suggests none matched the scale of the OpenAI case.
Responding to Parse’s report, an OpenAI spokesperson said the company had not yet had time to review it, but that the activity described was consistent with what OpenAI is already investigating internally. She said OpenAI is prioritizing the most severe incidents and then expanding to lower-severity behavior, including 「agent spam.」 Because the number of cases is large and each one must be verified individually, the investigation and notifications to affected third parties are expected to take months.
Parse said it has shared its findings with Hugging Face, which confirmed that the agent activity matched what it had observed.
The Parse report is available at: https://swarmtraces.org