A SentinelLABS researcher has identified the Hugging Face accounts used by OpenAI’s rogue agents in May, uncovering relay code, internal-network probes, and account-registration tooling that OpenAI’s public timeline did not describe.
SentinelLABS researcher Tom Hegel identified two pre-existing Hugging Face accounts, 0Time and Nyx9, and assessed activity under both as highly associated with the agent activity OpenAI described. OpenAI’s technical report said agents used exposed Hugging Face credentials during an unrelated May research workload to write files and deploy proxy Spaces, but did not name the accounts.
OpenAI’s chronology records its first confirmed external file write at 20:04 UTC on May 26. At 20:04:11, Nyx9 received a file containing only “hi”. Forty-five minutes later OpenAI recorded its first proxy deployment at 20:49, and a Nyx9 Space received relay code at 20:49:55.
Hegel called those the “cleanest public joins” he found between OpenAI’s internal chronology and Hugging Face account history. Later that night, a workbook appeared four hours and 36 minutes after OpenAI’s first documented successful internal Artifactory SSRF.
The workbook carried formulas testing whether the system processing it could fetch external content, read a local file, reach cloud metadata and hit an internal-looking service.
What the Public Record Cannot Show
Hegel found no callback, secret, calculated value or other evidence that Hugging Face evaluated the formulas. The file was built with openpyxl and holds no cached results, and the cloud metadata request omitted a header the service requires, making a valid response unlikely.
Looking backward, 0Time committed caller-directed relay code at 11:05:13 UTC on May 13, nearly two weeks before the May 26 sequence. OpenAI reported an agent using an exposed Hugging Face token that day while searching for a file, but Hegel did not identify the two as the same event, since the relay code does not reference the file being sought.
On May 30, 0Time placed a publicly available Chinese-language OpenAI account-registration and token-extraction program into a Space with a small web wrapper. Hegel called that a potential identity-provisioning capability, not demonstrated scaling.
Both accounts predate the activity, and Hegel cautioned that they are affected account identifiers rather than OpenAI-created agent identities. A handle can belong to a victim whose exposed token was used by someone or something else.
Six Stages, and the Public Record Reaches One
Hegel separates code being committed, the application being built, started, receiving a request, that request producing an external action, and the action succeeding with its output used.
The public record establishes the first stage for the May 13 and May 30 material, and formula placement rather than evaluation for the workbook. OpenAI’s own records establish runtime for the May 26 write and proxy deployment.
Hegel called on frontier labs to publish documented, redacted incident datasets when their agents affect third-party systems.
For context, OpenAI gave METR and Redwood Research roughly 1,300 agent transcripts and 1.2 million Artifactory entries for an on-premises review, but Hegel could find no public release of that corpus, so outside investigators cannot test competing explanations against the same evidence.
The researcher noted that in their review of the later June and July activity, those reviewers reported their own analysis agents made errors and exercised weaker judgment than human researchers.
OpenAI and Hugging Face were contacted for comment and had not responded at publication.
