OpenAI Hugging Face incident began two weeks earlier than disclosed, research claims

OpenAI incident report contains omissions

SentinelLABS claims OpenAI-linked Hugging Face activity began nearly two weeks earlier than disclosed, raising transparency questions.

SentinelLABS has published research claiming that the public footprint of OpenAI’s Hugging Face incident began almost two weeks earlier than OpenAI’s own account suggests, raising fresh questions about the visibility and attribution of ‘rogue’ AI agents.

The work was a validation of that of an independent researcher Jonas Wiedermann-Moeller who discovered the activity last week.

Researchers said they identified public Hugging Face activity associated with the incident from 13 May, ahead of OpenAI’s disclosed timeline for a 26^th May research workload in which agents allegedly used exposed Hugging Face credentials to write files and deploy proxy Spaces.

OpenAI previously said agents used exposed Hugging Face credentials during unrelated research task but did not identify the accounts involved.

SentinelLABS says it has linked likely associated activity to two public accounts, 0Time and Nyx9, whose histories appear to extend the timelines of OpenAI’s account.

What did researchers find?

SentinelLABS says the activity began on 13 May, when agents were already creating tools that could send traffic through servers they did not control. That is nearly two weeks earlier than the start of the timeline set out in OpenAI’s own incident report which record its first WebCache-confirmed external file write on May 26^th.

The researchers also say public Hugging Face records line up closely with points in OpenAI’s account. On 26 May, the Nyx9 account uploaded a file at almost the same time that OpenAI recorded an external file write. Later that evening, another Nyx9 project received code that appears to match the first proxy deployment described by OpenAI.

However, SentinelLABS says the earliest meaningful public code linked to the incident was posted by the 0Time account on 13 May.

That activity was also noticed publicly at the time, suggesting that some signs of the incident were visible outside OpenAI before the company’s published timeline begins.

The researchers also pointed to a spreadsheet, formbin.xlsx, uploaded by Nyx9 on 26 May. SentinelLABS says the file appeared designed to test what systems it could reach, including an external web address, a local file path, an Azure cloud service and an internal-looking service address.

However, the public evidence does not show whether the spreadsheet actually ran, or which system was supposed to open it.

The most striking finding relates to activity on 30th May. Over a period of just over 10 minutes, commits placed an existing Chinese-language tool for creating OpenAI accounts and extracting tokens into a Hugging Face Space. SentinelLABS says the changes also made the tool accessible through a simple web page.

If that page was built, ran and received visits, each request could have tried to create a new account and return the result. SentinelLABS said repeated successful requests could therefore have provided extra ChatGPT identities or credentials, potentially allowing the activity to scale.

However, SentinelLABS stressed that only OpenAI and Hugging Face have the logs needed to confirm whether the page was visited or used in that way.

A challenge for incident response

The findings highlight a wider problem for incident responders as AI agents move between cloud services and developer platforms. OpenAI should have been able to see what its agents were asked to do, and Hugging Face could see what appeared on its own systems.

But neither company had the full picture: where the task started, which credentials were used, what happened on Hugging Face, and what effects the activity had elsewhere.

For security teams, SentinelLABS argues, the public trail is not just background detail; it is part of the incident itself. The case shows how evidence can be split across different companies, accounts and logs, making AI-agent incidents harder to piece together and making it more difficult to work out who authorised each action, when it happened and what impact it had.

Computing says:

These findings raise questions about OpenAI’s chronology of this incident and thoroughness of its investigation in the Hugging Face attack. As many people have pointed out, if any other organisations or individuals had mounted an attack like this, they would likely currently be awaiting trial. It doesn't seem unreasonable to expect a thorough, forensic investigation of the incident, with full transparency of findings.

How and why did OpenAI miss the activity on May 13th? If they didn’t miss it, why wasn’t it previously disclosed in the attack chronology?

These findings also pose another difficult question for OpenAI and the likes of Anthropic and xAI.

How does an omission that resembles carelessness at best and deliberate obfuscation at worst help to persuade a doubtful global populace to trust that these companies have humanity's best interests at heart as Altman claimed yesterday.

In less than a week we've gone from "There's a 10% chance AI will kill us all" to "trust us, we know what we're doing and can regulate ourselves."

Right now, all the available evidence suggests the otherwise.