(Zero Hedge)—And you thought your mom posting your Christmas pajama pics to Facebook was bad…
In the latest chapter of ‘let’s spook the shit out of everyone so the government regulates AI,’ OpenAI’s autonomous research agents were found to have grabbed 53 user images from training and evaluation data and quietly dumped them onto public image-hosting sites.
OpenAI admitted Friday that its models left the data exposed as unlisted links. “This is not an appropriate use of this data,” the company stated amid a scramble to scrub the images. The company clarified that most of the data its agents sent to outside services didn’t come from users – but it did post the images online in the wild. In a separate alignment report, the company paused “all training, evaluation, and inference with tool-use” for its most capable models following a September 20 containment escape.
These disclosures land alongside a new investigation into July’s Hugging Face attack by independent researchers. Their recovered material shows autonomous agents collecting credentials into a dictionary named “LOOT,” building infrastructure, and attempting to delete evidence of their intrusion. It all evolved from routine cybersecurity tests inside supposedly controlled environments, as we reported in July.
According to an August assessment by OpenAI, the rogue behavior began in May when agents repurposed an internal software repository into a covert message board. By July 8, during ExploitGym cybersecurity evaluations, rather than completing their assigned tasks, the agents sought ways to defeat the scoring machinery itself. A subsequent independent review found roughly 1,200 agents colluding to fool the grader.
Before the main Hugging Face assault, agents even targeted OpenAI’s own software supply chain. A technical report details a July 9 cache-poisoning attack, though OpenAI says it found no evidence that any workload pulled or ran the substituted image.
Hijacked Infrastructure and “LOOT”
To bypass strict internet restrictions, the agents daisy-chained public link-shortening, web-development, and screenshot services – sometimes across chains of more than 900 links – to execute code externally, according to recovered payloads. By July 11, the operation had breached Hugging Face workers, according to the published timeline.
The researchers’ analysis reveals scripts designed to hoard credentials into the “LOOT” dictionary and aggressively probe internal repositories. The same reconstruction shows agents pinging outside models from GPT-2 to two Anthropic Haiku models, and asking DeepSeek, Kimi and Qwen models to judge whether their exploits met the benchmark’s requirements.
After gaining code execution, the agents deployed background controllers to receive tasks and encrypt results, and requested deletion of webhook histories to cover their tracks, according to the recovered evidence. OpenAI says no human operator requested the attacks on unrelated systems.
