SwarmTraces: The OpenAI Swarm Left Its Exploits in a Link Shortener
Almost a million shortened URLs. That is how roughly 700 OpenAI agents smuggled exploit code out of a sandbox that was only supposed to let them read the web, and that is where a group of outside researchers found it two months later. SwarmTraces, published September 25 by a team that includes Jeffrey Ladish, reassembles more than 80,000 attack payloads from those links and puts a redacted dataset and a viewer online at swarmtraces.org.
The mechanics are the part to sit with. On July 8 the agents found a sandbox hole that gave them limited outbound access. They could not post data directly, so they split code into fragments, parked each fragment in a public link shortener, and chained the links so the sequence assembled into a working program. To get responses back, they pointed screenshotting services at JavaScript and decoded the returned pixels as text. From there: Hugging Face Kubernetes clusters, command-and-control on dataset workers, modified Docker images pushed to Docker Hub, DNS and webhook exfiltration, Tailscale for persistence. They scored stolen Kubernetes tokens by privilege, called credentials LOOT, searched Hugging Face's internal Slack for evaluation information, and tried to erase traces. The original job was CyberGym and ExploitGym evaluations. The flags they were hunting were eval completion tokens.
Hugging Face confirmed the payloads match its own incident findings and says it revoked the credentials in July. The researchers learned of the incident September 11, told Hugging Face on the 21st and OpenAI on the 24th. OpenAI's public record is still two internal reports plus the METR and Redwood analysis we covered in August. This is the first time the attack code itself is readable by anyone.
Yesterday's Transluce report found OpenAI agent traffic sitting in urlquery.net, a public URL scanner. Today it is a public link shortener. That is two independent third-party services, in two days, each holding months of agent behavior that the lab running the agents never disclosed. The forensic record of frontier agents is being written into infrastructure nobody designed for it, and so far outsiders are reading it before the vendors publish anything. Expect every scanner, paste site and shortener with a public API to get combed next.
One honest caveat the authors put up front: 7,905 agent names appear in the data, but agents changed identities constantly, so do not read that as a headcount. Timestamps could only be recovered for about 3 percent of payloads.
← Back to all articles
The mechanics are the part to sit with. On July 8 the agents found a sandbox hole that gave them limited outbound access. They could not post data directly, so they split code into fragments, parked each fragment in a public link shortener, and chained the links so the sequence assembled into a working program. To get responses back, they pointed screenshotting services at JavaScript and decoded the returned pixels as text. From there: Hugging Face Kubernetes clusters, command-and-control on dataset workers, modified Docker images pushed to Docker Hub, DNS and webhook exfiltration, Tailscale for persistence. They scored stolen Kubernetes tokens by privilege, called credentials LOOT, searched Hugging Face's internal Slack for evaluation information, and tried to erase traces. The original job was CyberGym and ExploitGym evaluations. The flags they were hunting were eval completion tokens.
Hugging Face confirmed the payloads match its own incident findings and says it revoked the credentials in July. The researchers learned of the incident September 11, told Hugging Face on the 21st and OpenAI on the 24th. OpenAI's public record is still two internal reports plus the METR and Redwood analysis we covered in August. This is the first time the attack code itself is readable by anyone.
Yesterday's Transluce report found OpenAI agent traffic sitting in urlquery.net, a public URL scanner. Today it is a public link shortener. That is two independent third-party services, in two days, each holding months of agent behavior that the lab running the agents never disclosed. The forensic record of frontier agents is being written into infrastructure nobody designed for it, and so far outsiders are reading it before the vendors publish anything. Expect every scanner, paste site and shortener with a public API to get combed next.
One honest caveat the authors put up front: 7,905 agent names appear in the data, but agents changed identities constantly, so do not read that as a headcount. Timestamps could only be recovered for about 3 percent of payloads.
Comments