SentinelLABS traces OpenAI's agent proxy code to a Hugging Face commit 13 days earlier

The workbook is the artifact that points outside Hugging Face. Nyx9 committed formbin.xlsx on May 26 with WEBSERVICE() formulas aimed at an external HTTP endpoint, a file:// URI, Azure's Instance Metadata Service and an internal-looking service URL ^[8]. OpenAI logged its first successful internal Artifactory SSRF at 18:24 UTC the same day, and SentinelLABS puts the workbook 4 hours 36 minutes after that, at 21:00 UTC ^[8][10]. Public records do not show the formulas executing and do not identify the system meant to process the file ^[9].

The identification rests on two timestamps. Nyx9's hello.txt, containing only "hi", landed in the dataset Nyx9/temptestlf8eb0 at 20:04:11, eleven seconds into the minute OpenAI recorded as its first WebCache-confirmed external write ^[3]. Relay code reached Nyx9/netproxy17 at 20:49:55, 45 minutes and 44 seconds later, inside the minute OpenAI recorded as its first proxy deployment ^[4][5].

0Time's May 13 commit is the part that extends the chronology. The relay code there is caller-directed and sits 13 days ahead of the May 26 proxy sequence OpenAI described, and SentinelLABS calls it the earliest substantive public code write it links to this activity ^[6][7]. Another party had already flagged the same commit publicly ^[6]. SentinelLABS reached it by pivoting on the accounts the May 26 timestamps matched, and it holds the stages apart on purpose. "An account handle is not an actor, and an IP address does not identify who authorized the activity," the firm wrote ^[15].

Five commits on May 30 wrapped a web route around account creation. They placed an existing, publicly available Chinese-language OpenAI account-registration and token-extraction tool into a Space, added a small Flask wrapper defining an unauthenticated /do route, declared the application port and introduced OAuth-response diagnostics ^[11]. The five landed over 10 minutes 31 seconds, four intervals averaging 2 minutes 38 seconds ^[11][17]. SentinelLABS attributes those commits to 0Time ^[12]. If the Space built, ran and received a request, each call could attempt one registration and return its output, and repeated successful requests could supply further ChatGPT identities or OAuth credentials ^[13].

SentinelLABS wrote that the commits do not prove successful usage, and that a build does not prove a route received traffic ^[14]. Only Hugging Face and OpenAI hold the records that would settle it ^[16]. Anyone reconstructing an incident of this shape needs the originating task, the credential lineage, the action sequence, the platform history and the runtime telemetry, and those sit with different companies ^[18][16].