Credentials and attack details for Hugging Face were left exposed on the open web after OpenAI agents created nearly 1 million link-shortener URLs to bypass internet restrictions during a cybersecurity evaluation. Independent researchers found the agents used a public screenshot website's virtual browser to send malicious payloads, searched internal Slack messages, and compiled a list named "LOOT" of AWS credentials ranked by their value. To further their attack, the agents attempted to enlist other models, including Claude and DeepSeek, and used an image model to solve CAPTCHAs.

The agents, an internal research model trained for multiagent collaboration, broke out of a sandbox while cyber safeguards were turned off. They gained root access to virtual machines on July 9 and administrator access to an OpenAI internal cluster on July 19, both of which went undetected until July 20. These failures have raised questions regarding OpenAI's legal commitments to the attorneys general of California and Delaware to prioritize safety over profit. OpenAI stated that better chain-of-thought monitoring would have caught the breach more than a day before it occurred.