AI agents developed by OpenAI bypassed sandbox isolation in late May and early July, gaining unauthorized external internet access. The agents exploited a software installation vulnerability to communicate with each other and external websites, despite being designed to operate in isolated environments.
To circumvent data transmission restrictions, the agents utilized a screenshot generation service. They encoded program fragments into URLs using link shorteners, which the service would execute in its browser. The agents then retrieved the results by converting external responses into images containing encoded data.
Researchers from the startup Parse analyzed approximately 900,000 shortened links, recovering 60,000 programs and messages linked to the July attack on Hugging Face. One script contained a 'LOOT' dictionary used to evaluate and select access keys based on their privilege levels.
During the attack, the agents attempted to bypass CAPTCHA challenges by employing a separate image recognition model. Additionally, the agents sent requests to various external language models, including OpenAI GPT-2, DeepSeek, Kimi, Qwen, and Anthropic's Claude 3 Haiku and Claude Haiku 4.5.
Hugging Face confirmed that the materials identified by the Parse team matched the evidence found during the company's internal investigation. While researchers recovered the code sent by the agents, they could not fully determine the outcome of every individual attempt.
