Source Details

{
    "source_type": "extension",
    "content_hash": "c628fbce7c400fbc6592b66fc4354814d5bf7ba4b97341400482c631276c19c3",
    "submitted_via": "chrome_extension",
    "extension_version": "1.0.18",
    "original_url": "https:\/\/www.nytimes.com\/2026\/09\/25\/technology\/openai-hugging-face-hack.html?emc=edit_nn_20260926&nl=the-morning&segment_id=227102",
    "parsed_content": "Artificial IntelligenceOpenAI\u2019s Systems Went RogueA.I.-Driven Medical CostsU.S.-China RaceTraining A.I. ModelsReader Questions, AnsweredAdvertisementSKIP ADVERTISEMENTSupported bySKIP ADVERTISEMENTHow OpenAI\u2019s Rogue A.I. Agents Tried to Trick a Robot DetectorA new report by a Bay Area start-up called Parse adds details to an incident that has shocked the A.I. world and led to calls for closer government regulation.Listen \u00b7 8:18 min Share full articleSam Altman, center, OpenAI\u2019s chief executive, spoke at a Security Council meeting during the United Nations General Assembly on Wednesday.Credit...Dave Sanders for The New York TimesBy Dylan FreedmanGraphic by Keith CollinsDylan Freedman reports on artificial intelligence and has more than a decade of experience as a software engineer.Sept. 25, 2026Sign up for the On Tech newsletter. Get our best tech reporting from the week. Get it sent to your inbox.An artificial intelligence system from OpenAI attempted to use another A.I. model to evade a robot detection test as it tried over and over to break into a company\u2019s computers, according to a report released on Friday by a Bay Area start-up.In July, OpenAI disclosed that its A.I. agents went rogue and hacked the software company Hugging Face. Since then, new and often startling details about the incident have emerged, leading to a national debate about A.I. safety and whether so-called frontier labs like OpenAI should be regulated in some way by the government.Now, the report from engineers from the start-up, called Parse, and other researchers offers one of the most comprehensive public accounts of the Hugging Face hack: a tranche of nearly one million links from internet link-shortening services that OpenAI\u2019s agents created from July 9 through July 13 in order to help conduct the cyberattack.These shortened addresses encoded bits of information that the agents chained together to attempt complex attacks, such as solving CAPTCHAs, the tests that websites use to block access by robots. The agents also tapped into other A.I. models, like early versions of ChatGPT and Claude, and attempted to search through and download private messages from Hugging Face\u2019s internal Slack, a messaging service for employees.AdvertisementSKIP ADVERTISEMENTWhile it is not clear if these attempts were successful, the report offers new insight into what these A.I. agents were planning to do, without any human involvement.Other A.I. companies, including Meta, Google and Anthropic, have also acknowledged similar incidents involving their A.I. models in recent weeks. But while the full extent of rogue activity by OpenAI\u2019s A.I. agents is still unclear, what is already publicly known dwarfs the incidents involving the other companies.OpenAI has acknowledged that its A.I. agents targeted several more websites and services, including a German online forum the A.I. agents turned into a message board, and the website of the Australian Institute of Health and Welfare.\u201cThis is just not anywhere near a one-off,\u201d said Alex Forman, the founder of Parse. \u201cIt is warning shot after warning shot.\u201dParse engineers discovered the data by combing public links on the internet after they initially thought OpenAI\u2019s agents may have utilized their own platform, a service that converts websites into data that can be used by developers. (The agents did not use Parse.)AdvertisementSKIP ADVERTISEMENTIn a statement, an OpenAI spokeswoman said that the company had not had a chance to review the Parse report, but that the activity described by its engineers was consistent with what OpenAI was already investigating.\u201cWe\u2019re prioritizing review of the most serious incidents while expanding to lower-severity activity, including agents spamming websites,\u201d the spokeswoman said. \u201cGiven the number of cases and the need to verify each one, we expect this work and notifications to affected third parties to take months.\u201d(The New York Times has sued OpenAI and Microsoft, claiming copyright infringement of news content related to A.I. systems. The two companies have denied the suit\u2019s claims.)\n \n \n \nWhat the agent was \nblocked from doing\nSend data to a target web page\nGet data \nback from it\nHow the agent \ngot around it\nHid a custom program in a series of many hyperlinks \nHidden data\nPassed the first link to an approved screenshot service \nThe service opened the first link, which kicked off a chain of requests for the subsequent links until the full custom program was assembled \nScreenshot\nThe custom program rendered a fake web page\nThe data from the target went back to the program\u2019s fake page, which displayed the data in an image\nThe program then sent data to the target web page\nWhat the agent was blocked from doing\nSend data to a target web page\nGet data \nback from it\nHow the agent got around it\nHid a custom program in a series of many hyperlinks \nHidden data\nPassed the first link to an approved screenshot service \nThe service opened the first link, which kicked off a chain of requests for the subsequent links until the full custom program was assembled \nScreenshot\nThe custom program rendered a fake web page\nThe program then sent data to the target web page\nThe data from the target went back to the program\u2019s fake page, which displayed the data in an image\n \n The New York TimesA sophisticated attackOpenAI\u2019s agents were supposed to be kept in a sandbox, a computing environment without access to the internet. But in late May, and again in early July, the agents hacked into a software installation tool without OpenAI researchers realizing what was going on. These hacks helped the agents, which were supposed to be isolated from one another, establish a message board for communicating.AdvertisementSKIP ADVERTISEMENTThe hacks also allowed the agents to get online and gain access to websites, but they were unable to submit data to those sites, according to the Parse report, which was written by Mr. Forman, Mishka Kharlov and Will Tom from Parse along with five additional A.I. researchers.The agents attempted to use many different methods to solve that problem. In one, they used website screenshots and shortened links to cobble data together in chunks that combined to operate as a computer program. Here\u2019s how it worked:The agents could ask a public screenshot service to load a specially crafted internet address. That address, or URL, would load computer code.URLs can be only so long. So the agents split their computer code into many smaller chunks. They used link-shortening services to store the URLs.The screenshot service loaded one shortened link, which fetched the first chunk of code. The program could fetch the next link, and then the next. That process repeated until the full program was loaded and run by the screenshot service.Finally, the program created a visual code similar to a QR code or bar code to transmit the data the agents needed back from the screenshot service.\u201cThese agents got up to so much. They were so clever,\u201d said Jeffrey Ladish, the executive director of an A.I. safety nonprofit called Palisade Research who helped the engineers with their investigation. \u201cThe models are like, \u2018All right, well, we got this link shortener, we have these screenshot services, no problem, we\u2019re ready to go.\u2019\u201dA.I. running A.I.The A.I. agents appeared interested in running A.I. models themselves.Early in the attack, the agents tried to create new accounts on Hugging Face, which requires solving a CAPTCHA, a visual test designed to thwart robots but not humans. So the agents ran an A.I. model designed to recognize images.ImageCl\u00e9ment Delangue, the chief executive of Hugging Face, appeared by video at the United Nations Security Council meeting on Wednesday.Credit...Dave Sanders for The New York TimesA.I. safety experts often warn about scenarios in which A.I. systems launch other A.I. models, which would hamper human efforts to control and shut the systems off if they got out of hand.AdvertisementSKIP ADVERTISEMENTIn one instance, the engineers observed the agents attempting to message other A.I. models, including an early model from OpenAI called GPT-2 and open-source Chinese models such as DeepSeek, Kimi and Qwen. The agents also attempted to message two Anthropic models, Haiku 3 and Haiku 4.5, using an online chat service. \u201cI think that\u2019s the only instance we have of these models trying to run another model,\u201d Mr. Forman said of the agents\u2019 attempts to send messages to other A.I. models.What we still don\u2019t knowThe data the engineers released includes the contents of 900,000 shortened URLs they scanned from the public internet. From these URLs, the engineers were able to construct around 60,000 computer programs and messages the agents used in the Hugging Face attack. The engineers could see only the programs the agents created and not the results, so they could not say for certain how successful each attempt was.\u201cOne that really stood out to me,\u201d said Mr. Kharlov, a founding engineer at Parse, was a dictionary of secret access keys \u201clabeled \u2018LOOT\u2019 in all capitals.\u201d He added that the agent had created a custom scoring system to rank the exposed Hugging Face credentials and keys and bring the top five back to the other agents.While the agents were barraging Hugging Face with hacks, they hacked into OpenAI\u2019s own research infrastructure.AdvertisementSKIP ADVERTISEMENT\u201cWe still know basically nothing about the incident that came after Hugging Face, like two days later, inside OpenAI\u2019s own network,\u201d Mr. Forman said.The Parse engineers disclosed their findings to Hugging Face, confirming with the company that the agent activity matched what it had observed.\u201cSomehow there are a million URLs floating around and possibly a lot more that have not been disclosed to the victim of the attack,\u201d Mr. Forman said. \u201cI find it hard to believe.\u201dAdvertisementSKIP ADVERTISEMENT",
    "published_at": "2026-09-25T20:01:21+00:00",
    "author_name": "Dylan Freedman",
    "site_name": "The New York Times",
    "section": "Technology",
    "publisher": "The New York Times Company",
    "ai_headline": "How OpenAI\u2019s Rogue A.I. Agents Tried to Trick a Robot Detector",
    "ai_simplified_title": "OpenAI AI Agents Attempt to Evade Robot Detector",
    "ai_excerpt": "A new report details how OpenAI's A.I. agents went rogue, attempting to hack Hugging Face and evade robot detection tests using other A.I. models and complex cyberattack methods. This incident has sparked debate about A.I. safety and regulation.",
    "ai_subject_tags": [
        "Artificial Intelligence",
        "AI Safety",
        "Cybersecurity",
        "OpenAI",
        "Hugging Face",
        "AI Regulation",
        "Technology"
    ],
    "ai_context_type": "News",
    "ai_context_details": {
        "tone": "informative",
        "perspective": "neutral",
        "audience": "general",
        "credibility_indicators": [
            "expert_quotes",
            "data_cited",
            "company_statements"
        ]
    },
    "ai_source_vector": null,
    "ai_confidence_score": 0.9999999999999999,
    "ai_extraction_metadata": {
        "extracted_at": "2026-10-01T00:03:05.548640Z",
        "ai_model": "gemini-2.5-flash",
        "extraction_method": "automated",
        "content_length": 9953,
        "metadata_prompt_body_chars": 9953,
        "metadata_prompt_truncated": false,
        "url": "https:\/\/nytimes.com\/2026\/09\/25\/technology\/openai-hugging-face-hack.html",
        "existing_metadata": {
            "author_name": null,
            "published_at": null,
            "domain_name": "nytimes.com",
            "site_name": null,
            "section": null,
            "publisher": null
        },
        "openai_refusal_gemini_fallback": false
    }
}

{
    "extracted_at": "2026-10-01T00:03:05.548640Z",
    "ai_model": "gemini-2.5-flash",
    "extraction_method": "automated",
    "content_length": 9953,
    "metadata_prompt_body_chars": 9953,
    "metadata_prompt_truncated": false,
    "url": "https:\/\/nytimes.com\/2026\/09\/25\/technology\/openai-hugging-face-hack.html",
    "existing_metadata": {
        "author_name": null,
        "published_at": null,
        "domain_name": "nytimes.com",
        "site_name": null,
        "section": null,
        "publisher": null
    },
    "openai_refusal_gemini_fallback": false
}