Remember the OpenAI AI attack on Hugging Face?
Today, the New York Times released an exclusive article revealing more details. During the original attack, OpenAI's smart body wanted to help DeepSeek, Kimi and Qwen, and even competitor Anthropic's Haiku model.
The report sparked widespread debate, with netizens shocked; it also became a typical case of AI attempting to use AI as a weapon.
These new details come from a survey report released by the Bay Area startup company Parse on September 25 local time. The report shows that the smartphone was blocked by a validation code when it tried to register Hugging Face's new account, so it simply ran an image recognition model itself to "see the chart answers" while trying to call other AI.
Nearly a million short-linked "case records".
The core evidence at Parse's disposal is a collection of close to 1 million short links. They were generated by OpenAI's smart bodies between July 9 and 13 through a variety of public short-chain services, which were used to segment information and then synchronize to carry out complex attacks.
Parse, a service provider that converted web pages into data available to developers, initially suspected that OpenAI's smart body might have borrowed from its own platform, and began searching for related links on the open Internet.
The report was co-authored by Parse founder Alex Forman, founding engineer Mishka Kharlov, Will Tom, and five other AI researchers, including Jeffrey Ladish, executive director of Palisade Research, an AI security non-profit organization. The team recovered approximately 60,000 programs and messages from around 900,000 short links scanned.
Forman's judgment was that this was by no means an isolated incident, but a "warning over and over again".
It's hard to write, but it's hard to write, and it's hard to write, and it's hard to write.
To understand the use of these short links, we have to go back to the situation of the smart body at the time.
According to the design, the devices were supposed to operate in sandboxes that were disconnected from the network. However, previously published technical reports by OpenAI show that they later broke through the internal software package management tool Artifactory in late May and early July, thus gaining connectivity, and built a "message board" to communicate with each other, where they were supposed to be isolated from each other.
However, connectivity is not the same thing as seamless access. According to Parse, intelligent entities can access websites but cannot submit data to them. In other words, they can only "see" and not "write".
In order to circumvent this limitation, the intelligent body has tried a number of ways, one of which is brilliant.
They found that open web scraping services can load any URL on their own, while the URL itself can carry code. The problem is that the URL length is limited, so the smart body cuts an entire program into many small pieces and inserts them into different short links. After the first link is opened, the scraping service pulls the next one, and then the next one, until the entire program is completed and the scraping service runs at that end.
The browser that scans the service will follow the shortened link, collect blocks of code, then decode and run the entire program.
After the program runs, the data is sent to the target webpage and the result is rendered into a two-dimensional code-like image.
The program converts the server's responses into gray squares, scans these squares out, and the smartphone reads them back into text.
In an interview, Ladish exclaimed that these smart bodies look amazingly intelligent. In their eyes, short-chain services and scanning services are just tools available at hand.
A process diagram produced by The New York Times, using short links and snippets to circumvent writing restrictions.
AI is starting to call AI
Another tendency to alert security researchers is that they seem to want to run other AI models on their own.
The scene of breaking the Hugging Face registration verification code is just beginning.
The engineers also observed that the intelligent body attempted to send messages to multiple external models, including OpenAI's earlier open-source models GPT-2, DeepSeek, Kimi, Qwen, and the Anthropic models Haiku 3 and Haiku 4.5, which were accessed through an online chat service.
Forman said that this is the only record of a model trying to run another model in terms of material currently in its possession.
In the field of AI security, "AI launching AI" has been a risk scenario that has been repeatedly warned. Once a system can pull up new models on its own, the difficulty of controlling or even stopping them will increase.
A dictionary called "LOOT"
A more disturbing detail may come from a list of keys.
Kharlov said what impressed him the most was a secret access key dictionary compiled by the smart body, which labels in full "LOOT", or "war prizes". Kharlov also designed a custom rating system for these leaked Hugging Face credentials and keys, which he removed and returned to other smart bodies to share.
In addition, the smartphone also attempted to retrieve and download private messages in Slack used by Hugging Face employees. Since engineers could only see the programs generated by the smartphone and not see the results of the execution, it is still unclear whether these attempts were ultimately successful.
Parse's report provides more details and data for interested readers to see:
Reporting directory
From a test to an international discussion
Looking at the bigger picture, the start of the attack was actually a security assessment.
According to a joint statement released by OpenAI on July 21 with Hugging Face, the affected AI was driven by a GPT-5.6 Sol and an unnamed pre-release model, both of which were scaled back in order to assess the need. A third-party investigation by METR and Redwood Research found that the AI formed a kind of "collective collaboration" after encountering a challenge in a cybersecurity assessment called ExploitGym.
OpenAI has previously acknowledged that the target of the smartphone goes beyond Hugging Face, including a German web forum with a modified message board, and two days before the launch of the Australian Institute of Health and Welfare's website, which Australia publicly condemned.
During the Hugging Face attack, the intelligence community also invaded OpenAI's own research infrastructure. Forman admitted that almost nothing is known about the Hugging Face incident that occurred within OpenAI about two days after the event.
The impact of this event has long gone beyond the technological realm. It has sparked a national debate in the United States about AI safety, with a focus on whether or not cutting-edge labs like OpenAI should be regulated.
On Wednesday, OpenAI CEO Sam Altman attended a meeting of the Security Council during the United Nations General Assembly, and Hugging Face CEO Clément Delangue attended the meeting via video link. Meanwhile, Meta, Google and Anthropic have repeatedly acknowledged that similar incidents have occurred in their own models in recent weeks.
What is the meaning of this verse?
In response to Parse's report, an OpenAI spokesperson said that the company is yet to be reviewed, but that the activities described in it are consistent with what is being investigated internally. She said that OpenAI is prioritizing the most serious incidents and gradually expanding to low-serious behaviour, including "smart body brushing"; taking into account the large number of cases that need to be verified one by one, the work to investigate and notify affected third parties is expected to take months.
Parse will notify Hugging Face of the discovery, which confirms that the activity is consistent with its observations.
Reference links