# Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face

DevFeed: [Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face](<https://devfeed.tech/articles/agents-at-large-tracing-illicit-openai-agent-activity-on-hugging-face-30905.md>)

Original publisher: [Read original article](<https://www.sentinelone.com/labs/agents-at-large-tracing-illicit-openai-agent-activity-on-hugging-face/>)

Author: Tom Hegel

Published: 2026-09-16T10:00:34Z

Content type: article

Language: en

Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.](<https://devfeed.tech/sources/sentinellabs-we-are-hunters-reversers-exploit-developers-and-tinkerers-shedding-light-on-the-world-of-malware-exploits-apts-and-cybercrime-across-all-platforms.md>)

Topics: [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [Incident response](<https://devfeed.tech/topics/incident-response.md>), [hugging face](<https://devfeed.tech/topics/hugging-face.md>), [OpenAI](<https://devfeed.tech/topics/openai.md>), [ChatGPT](<https://devfeed.tech/topics/chatgpt.md>), [spaces](<https://devfeed.tech/topics/spaces.md>), [Flask](<https://devfeed.tech/topics/flask.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [HTTP](<https://devfeed.tech/topics/http.md>)

Tags: [agentic-ai](<https://devfeed.tech/tags/agentic-ai.md>), [agents](<https://devfeed.tech/tags/agents.md>), [chatgpt](<https://devfeed.tech/tags/chatgpt.md>), [flask](<https://devfeed.tech/tags/flask.md>), [http](<https://devfeed.tech/tags/http.md>), [hugging-face](<https://devfeed.tech/tags/hugging-face.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [openai](<https://devfeed.tech/tags/openai.md>), [research](<https://devfeed.tech/tags/research.md>), [spaces](<https://devfeed.tech/tags/spaces.md>), [token](<https://devfeed.tech/tags/token.md>)

## AI overview

SentinelLABS traces activity associated with two Hugging Face accounts, 0Time and Nyx9, that appears to extend OpenAI's published chronology. The report describes relay-code commits, a workbook containing unexecuted-looking external probes, and a Flask-wrapped tool that could potentially provision ChatGPT identities or OAuth credentials if deployed and invoked.

## Source excerpt

Two Hugging Face accounts reveal that OpenAI's agents staged relay code, internal probes and ChatGPT account registration beyond the published timeline.