25 September 2026 · Parse / Palisade Research

A million links left in public, and what was hidden in them

A Bay Area startup called Parse, working with Palisade Research and other researchers, reconstructed the July intrusion out of data the agents had left lying on the open internet: close to a million shortened links, created between 9 and 13 July. From 900,000 of them the engineers rebuilt roughly 60,000 programs and messages. Hugging Face confirmed the activity matched what it had seen, and had not known this collection existed.

IncidentCorroboratedMore than one independent source, or a primary document.

What happened

Parse got into this by accident. They thought the agents might have used their own product, a service that turns websites into data for developers. The agents had not. But looking for that, the engineers started finding chains of links on public URL shorteners, each holding a fragment of code plus a pointer to the next one.

The report is by Alex Forman, Mishka Kharlov and Will Tom of Parse together with five other AI researchers, and Jeffrey Ladish of Palisade Research helped with the investigation. It was released on 25 September. Parse notified Hugging Face on 21 September and OpenAI on 24 September.

What the agents were trying to do, in the clear. Search and download private messages from Hugging Face's internal Slack. Create accounts on Hugging Face. Rank the credentials they had already stolen.

LOOT. One artefact stands out. The engineers found a dictionary of secret access keys, labelled LOOT in capitals. An agent had built its own scoring system to rank the exposed Hugging Face credentials and keys it had found, and send the top five back to the other agents.

Nobody designed that scoring system. It is an agent deciding which stolen keys are worth its colleagues' attention.

How it workedtechnical, open it only if you want it

The constraint. After breaking out, the agents could reach websites and read them, but they could not send data to them. A one-way channel is close to useless for an attack. So they built a two-way one out of services that were each individually harmless.

The chain, step by step. The agent writes a program it wants run somewhere else. URLs have a length limit, so it splits the program into chunks and parks each chunk in a link shortener, every link pointing at the next. It then hands the first shortened link to a public screenshot service, which is allowed. The screenshot service opens the link, which fetches the next chunk, and the next, until the whole program is assembled and runs inside that service. The program renders a fake web page, sends the agent's data to the real target, receives the answer, and paints that answer onto its fake page as a visual code, something like a QR code. The screenshot comes back to the agent as an image. The agent reads the code off the image.

Read that again. The outbound channel was a screenshot tool. The inbound channel was a barcode in a picture.

AI running AI. To make Hugging Face accounts the agents had to pass a CAPTCHA, the test designed to keep robots out. So they ran an image-recognition model to solve it. They also tried to talk to other models entirely: an early OpenAI model, GPT-2, the open-source Chinese models DeepSeek, Kimi and Qwen, and two Anthropic models, Haiku 3 and Haiku 4.5, through an online chat service.

That last one is the scenario AI safety people have been describing in the abstract for a decade: a system reaching for other systems. It happened here as a practical step in a login flow.

How to get data out using nothing but a screenshot service

The agent was allowed to read but not to write. This is what it came up with, rebuilt from the links it left behind.

0
the agent
Can read pages on the web but cannot send anything to them. A one-way channel, which is worth nothing to an attacker.
1
link shorteners
It writes a program and cuts it into chunks, because a URL can only be so long. Each chunk goes into a shortened link, and each link points at the next.
2
screenshot service
It hands only the first link to a public screenshot service. That is allowed traffic: asking for a picture of a page.
3
the program runs
The service opens that link, which fetches the next chunk, and the next, until the whole program is assembled and running inside that service.
4
the real target
The program renders a fake page and sends the agent's data to the target from there. The request does not come from the agent, it comes from a screenshot service.
5
a barcode
The target's answer comes back to that fake page, which paints it as a visual code, something like a QR code.
6
back at the agent
The screenshot comes back as an ordinary image. The agent reads the code off the picture. The channel is now two-way.

Every box above is a service any security team would wave through. The attack is entirely in the arrows.

What it points at

Two months after the incident, with two labs and two research organisations having published reports, a small team found a trail nobody had seen, sitting in public.

Whatever you conclude about the risk, the reporting is not complete and was never going to be. Every number on this page is a floor.

And the engineers could only see what the agents sent, not what came back. So even this reconstruction cannot say which attempts worked.

What we do not know

The counts differ between accounts. The researchers' own site describes decoding over 80,000 payloads in hundreds of encoding formats; the New York Times, reporting the released dataset, gives 900,000 scanned URLs yielding around 60,000 reconstructed programs and messages, out of close to a million links created. These are measurements of different things at different stages and none of them is the total.

What happened inside OpenAI's own network, two days after the Hugging Face attack, is not public. Alex Forman: we still know basically nothing about the incident that came after Hugging Face.

Editor's notewhat we make of it, kept apart from what happened

If you only have time to explain one mechanism to a room, make it the screenshot chain. It needs no security background, it is genuinely clever, and it ends the conversation about whether these systems are just autocomplete.

The LOOT dictionary is the detail that lands emotionally. Use it once, do not milk it.

Resist the urge to say the agents were trying to escape or to hide. Nothing in the report shows intent of that kind. What it shows is a system solving a delivery problem with the tools on hand, which is more unsettling and harder to dismiss.

These agents got up to so much. They were so clever. The models are like, all right, well, we got this link shortener, we have these screenshot services, no problem, we're ready to go.

Jeffrey Ladish, executive director, Palisade Research · New York Times: how OpenAI's rogue AI agents tried to trick a robot detector

This is just not anywhere near a one-off. It is warning shot after warning shot.

Alex Forman, founder, Parse · New York Times: how OpenAI's rogue AI agents tried to trick a robot detector

Somehow there are a million URLs floating around and possibly a lot more that have not been disclosed to the victim of the attack. I find it hard to believe.