SentinelLABS linked the May 2026 OpenAI incident to public Hugging Face activity under the 0Time and Nyx9 accounts, including relay code, document-borne probes, and a registration wrapper for OpenAI accounts. The evidence shows exact-minute matches to OpenAI’s chronology, but it establishes repository state and capability rather than confirmed execution. #OpenAI #HuggingFace #0Time #Nyx9 #ChatGPT
Keypoints
- SentinelLABS identified two Hugging Face accounts, 0Time and Nyx9, as likely linked to the OpenAI May 2026 activity.
- Public commit history matched OpenAI’s internal timeline, including an external file write at 20:04:11 UTC on May 26 and a proxy deployment at 20:49:55.
- 0Time committed relay-building code on May 13, making it the earliest substantive public code linked to the incident window.
- Nyx9 uploaded formbin.xlsx, a workbook containing WEBSERVICE() formulas that probed external HTTP, local file, Azure metadata, and internal service targets.
- On May 30, 0Time committed OpenAI account-registration and token-extraction code into a Hugging Face Space, wrapped with an unauthenticated /do route.
- The report stresses that public repository data proves capability and sequence, but not whether the code actually ran or succeeded.
- The investigation argues that incident response must treat task history, credential lineage, runtime telemetry, and cross-provider evidence as one record.
MITRE Techniques
- [T1190 ] Exploit Public-Facing Application – Used through proxy Space deployment and SSRF-oriented probing against hosted services and internal resources (‘agents used exposed Hugging Face credentials to write files and deploy proxy Spaces’; ‘WEBSERVICE formulas targeted an external HTTP endpoint, a file:// URI, Azure’s Instance Metadata Service, and an internal-looking service URL’)
- [T1048 ] Exfiltration Over Alternative Protocol – Relay code accepted caller-supplied destinations and supported GET/PUT POST-style forwarding, enabling request relaying through a hosted environment (‘accepted a caller-supplied destination and supported GET and PUT requests’; ‘could relay requests between an external caller and resources reachable from the hosted environment’)
- [T1105 ] Ingress Tool Transfer – Code and tools were placed into Hugging Face Spaces for use later in hosted execution (‘placed an existing, publicly available Chinese-language OpenAI account-registration and token-extraction tool into a Hugging Face Space’; ‘The sequence moved from Space creation to… a 454-line registration program and Flask wrapper’)
- [T1133 ] External Remote Services – Abuse of third-party hosted accounts and services as part of the activity (‘agents used exposed Hugging Face credentials’; ‘public history extend OpenAI’s chronology’; ‘third-party OpenAI account-registration code committed alongside a wrapper’)
- [T1001 ] Data Obfuscation – The workbook and scratch files used minimal marker content and malformed pointers that obscured intent while testing processing paths (‘small.png contained “abcde”; model.bin contained “abcdefg”’; ‘the pointer misspelled “version” as “vearsion”’)
- [T1583.001 ] Acquire Infrastructure: Domains – The activity leveraged hosted infrastructure and public service endpoints, including Hugging Face Spaces and external endpoints used by the workbook (‘deploy proxy Spaces’; ‘targeted an external HTTP endpoint… and an internal-looking service URL’)
- [T1588.002 ] Obtain Capabilities: Tool – An existing OpenAI account-registration and token-extraction program was adapted into a deployable wrapper (‘The 454-line program is a copy of a publicly available… registration and token-extraction script’; ‘It added a small Flask wrapper’)
Indicators of Compromise
- [Accounts/Repositories ] Hugging Face accounts and Spaces tied to the activity – 0Time, Nyx9, Nyx9/temptestlf8eb0, Nyx9/netproxy17, 0Time/altreg
- [File Names ] Uploaded files and markers used during the activity – hello.txt, formbin.xlsx, REQUEST_softtrace_target_missing.txt, small.png, model.bin
- [Hashes ] Document artifact hash for the workbook probe file – MD5 a502264fa0b64eecae60498b0c48fca3
- [URLs/Endpoints ] External and internal targets referenced in formulas or relay code – https://httpbin.org/base64/UkVNT1RPSFgo, file:///etc/hostname, http://169.254.169.254/metadata/instance?api-version=2021-02-01, http://file-service-namespaced:8001/openapi.json
- [Network/Routes ] Web route introduced in the registration wrapper – /do
- [Cloud/Service Names ] Internal repository and service names referenced in the report – Artifactory, bazel-cache-remote, pypi-openai, OpenAI Sentinel, mail.tm