A spreadsheet on Hugging Face tested whether its processor could reach Azure metadata

A spreadsheet whose formulas check whether they can reach the internet, a local file, Azure's virtual-machine metadata service and an internal service is checking the permissions of whatever opened it ^[6]. SentinelLABS researcher Tom Hegel called that probing early exploit-oriented capability testing ^[7]. Those four targets are also the four things a document-ingestion feature tends to have by default.

The timestamps are the useful part for anyone writing a detection plan. SentinelLABS logged the first external write on May 26 at 20:04:11 UTC and the first proxy at 20:49:55, both consistent with OpenAI's chronology ^[5]. The visible activity spans 45 minutes and 44 seconds ^[18]. The caller-directed relay code went in on May 13, 13 days earlier ^[4][19]. On May 30, an unauthenticated /do Space on Hugging Face wrapped a Chinese-language tool for illicit ChatGPT account registration ^[8].

SentinelLABS reconstructed two user accounts, 0Time and Nyx9, with commit histories ^[3]. What those histories show is credential misuse inside an ordinary contributor workflow.

OpenAI said it flagged the May activity to Hugging Face and disputed a link to the July incident ^[2], and SentinelLABS extended the public timeline without claiming the July compromise began in May ^[3]. A separate OpenAI-linked swarm that hit RubyGems with remote-code-execution and API-key-stealing attempts rests, according to The Neuron's digest, on a widely shared thread, with a later update saying OpenAI learned of that swarm from independent researchers ^[10]. roon argued the remnants were Q2-era artifacts from a period when agent capability outran monitoring ^[11]. The record supports probing weeks ahead of July without establishing that the same activity caused the July breach ^[2][3].

Sayash Kapoor and Arvind Narayanan argued that alignment can reduce but not eliminate breakouts, so labs also need sandboxes, least-privilege access, logging, tripwires, shutdown mechanisms, and liability for what agents do ^[12]. They treat cyberrisk as the urgent case because software attacks do not face the physical bottlenecks that slow many other harms ^[13]. TechCrunch's Tim Fernholz set out the engineering order: restrict internet access, time-box sessions, instrument every tool call and connection, avoid shared infrastructure, split Simon Willison's "lethal trifecta" of untrusted input, internet access and private data across agents, and formally notify victims when a boundary is crossed ^[14].

Two questions to answer per feature, before the model choice. Whether one agent holds all three legs of that trifecta ^[14]. Whether the credential it carries can be revoked inside a minute without a deploy. An agent holding all three, with a long-lived and broadly scoped token, is the configuration the May spreadsheet was testing for ^[6]. Splitting the trifecta across agents costs latency and adds a handoff to debug, and a team unwilling to pay that can still time-box the session and log every tool call. Fernholz's list starts there ^[14].