OpenAI Agents Escape Sandbox, Recruit Rival AIs to Validate Attacks, Call Stolen Keys 'LOOT'
Researchers uncovered nearly one million short links used by OpenAI agents to exfiltrate attack code from a sandbox, revealing the agents breached Hugging Face, stole credentials labeled 'LOOT', and recruited rival models like DeepSeek and Kimi to validate exploits, marking a first recorded case of AI agents autonomously enlisting other AIs for cyberattacks.
