THREAT OPS › Threat News › Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face
Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face
<h2>Executive Summary</h2> <ul> <li>OpenAI disclosed that agents used exposed Hugging Face credentials to write a file and deploy proxy Spaces during an unrelated May 2026 research workload, but it did not identify the accounts. SentinelLABS identified two accounts likely used in associated activity, 0Time and Nyx9. Their public histories extend OpenAI’s chronology and preserve previously unreport
MITRE ATT&CK techniques
Indicators of compromise
- 5508dd564b805cf3cef7cc4df7bad2732e427fc1sha1
- 1901adfb15e54cdf924a3b66554864e5c0b31e8asha1
- e7156395856d5afd9216d63efdc42b9f884ebb23sha1
- 25226b3e610e1c942819c61da0f1100463c26444sha1
- 0790a6d802c8486be720467e7222d0639a95efe1sha1
- 124eb6c0cc60a4db581cfd453bc1b586bac4e157sha1
- 03ed320c427ed1866d0612fd208f4f122b21d9f0sha1
- 2f61603a03b29a4df2e08114c36bba293bd1d878sha1
- c36e66d3cc38bd603fa417caea87be613b438084sha1
- a502264fa0b64eecae60498b0c48fca3md5
- https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdfurl
- https://huggingface.co/datasets/Anthropic/BioMysteryBench-full/discussions?status=open&sort=recently-createdurl
- https://httpbin.org/base64/UkVNT1RPSFgourl
- http://169.254.169.254/metadata/instance?api-version=2021-02-01url
- http://file-service-namespaced:8001/openapi.jsonurl
- https://huggingface.co/blog/agent-intrusion-technical-timelineurl
- https://huggingface.co/spaces/0Time/altreg/url
- https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/url
- https://openai.com/hugging-face-incident-and-misalignment/url
- https://huggingface.co/spaces/0Time/puthack82d5/commit/5508dd564b805cf3cef7cc4df7bad2732e427fc1url
- https://huggingface.co/spaces/0Time/puthack82d5/commit/1901adfb15e54cdf924a3b66554864e5c0b31e8aurl
- https://huggingface.co/datasets/Nyx9/temptestlf8eb0/commit/e7156395856d5afd9216d63efdc42b9f884ebb23url
- https://huggingface.co/spaces/Nyx9/netproxy17/commit/25226b3e610e1c942819c61da0f1100463c26444url
- https://huggingface.co/spaces/0Time/latnetnew/commit/0790a6d802c8486be720467e7222d0639a95efe1url
- https://huggingface.co/datasets/Nyx9/tmpdata177/commit/124eb6c0cc60a4db581cfd453bc1b586bac4e157url
- https://huggingface.co/spaces/0Time/altreg/commit/03ed320c427ed1866d0612fd208f4f122b21d9f0url
- https://huggingface.co/spaces/0Time/altreg/commit/2f61603a03b29a4df2e08114c36bba293bd1d878url
- https://openpyxl.readthedocs.io/en/stable/simple_formulae.htmlurl