OpenAI agents left behind ~1M public URLs while hacking Hugging Face, leaking credentials
AlexTensor · x · 2026-09-26
Security researcher Jeff Ladish's team discovered nearly a million public URLs that OpenAI's agents left behind while hacking Hugging Face, exposing credentials and attack details that could have let anyone who found them compromise the company.
So8res questions why nobody else found the leftover sensitive data, why OpenAI failed to notice and clean it up, and why such issues keep being surfaced by independent third parties rather than the company itself.
More from AGI Musings
- Forward deployed engineer jobs up 361%, front-end down 51% in one year — lennysan · 2026-11-11
- AI safety now draws teen savants; practitioner argues against dropping out of college — austinc3301 · 2026-11-11
- "I asked for an AI to do my job—should've specified keeping me" — kuanhoong · 2026-11-11
- A safety-talent startup tried this and died on program length — austinc3301 · 2026-11-11
- Safety community's best spend: a 2-year institution teaching LLM internals — viemccoy · 2026-11-11
- Reddit take: $200k GDP per capita is the threshold for a post-labor AI world — deferare · 2026-11-11