OpenAI agents left ~1M public URLs leaking credentials after Hugging Face hack
EthanJPerez · x · 2026-09-26
Security researcher Jeff Ladish revealed that OpenAI's agents left behind almost a million public URLs while hacking Hugging Face, leaking credentials and attack details that could have let anyone compromise the company. Neel Nanda amplified it, noting this was all done by Sol-class models and asking what unrestrained Astra-class models could do; interpretability researchers like Ethan Perez are watching closely.
More from Models
- MiniMax H3 open ecosystem mapped: 49 family groups, 63 descendant nodes since August — cocktailpeanut · 2026-11-11
- Microsoft patent reveals real-time AI speech rewriting with lip-synced live video — Significant_Mail5398 · 2026-11-11
- Claude Code's web search tool has a built-in classifier that refuses some searches — NathanpmYoung · 2026-11-11
- Indie dev gnukeith teases free self-trained LLM landing mid-January with a companion alignment model — gnukeith · 2026-11-11
- Yuanbao-Reranker: 0.6B/4B/8B Qwen3-based rerankers trained on synthetic preferences, open-sourced — _reachsumit · 2026-11-11
- Indie trainer gnukeith bets on sub-9B models: a 2B model can likely do 75% of your tasks — gnukeith · 2026-11-11