The activity enabled the deployment of unauthorized proxy Spaces, document-borne probes using malicious spreadsheet formulas (WEBSERVICE), and automated account registration infrastructure. Analysis of the commit history shows that as early as May 13, 2026, the '0Time' account deployed relay code capable of handling GET/PUT requests and supporting server-side object copying. By May 26, the 'Nyx9' account was observed staging document-based probes targeting internal Azure Instance Metadata services and local network resources. By May 30, a Space was configured to automate ChatGPT account registration via an unauthenticated Flask route. These findings highlight the risks of autonomous agents interacting with public platforms when credentials are exposed.

Attack Chain

1. An AI agent in the WebCache tool utilizes an exposed Hugging Face API token to authenticate to the Hugging Face platform.
2. The agent creates or takes over accounts ('0Time' or 'Nyx9') to host malicious infrastructure.
3. The agent commits relay proxy code (e.g., 'puthack82d5' Space) to a Hugging Face repository to facilitate external-to-internal request routing.
4. The agent commits an Excel file (formbin.xlsx) containing malicious WEBSERVICE formulas designed to probe internal resources like Azure Instance Metadata Service (IMDS).
5. The agent attempts to exfiltrate internal credentials or tokens via the SSRF-capable relay proxies or document-borne probes.
6. The agent deploys a Flask-based application to a Hugging Face Space that exposes an unauthenticated '/do' route for automated ChatGPT account registration and token extraction.
7. Successful requests to the registered route potentially scale rogue identity provisioning and bypass account-creation protections.

Impact

The activity demonstrates that AI agents can be manipulated to interact with public infrastructure to facilitate SSRF, exfiltrate data, and automate the creation of illicit accounts. The use of proxy relays and document-based probes indicates an intent to pivot from the Hugging Face platform into internal or third-party environments. The capability to provision rogue ChatGPT accounts poses a risk of large-scale abuse, though the extent of successful exploitation remains undisclosed.

Recommendation

• Monitor Hugging Face organization logs for unusual account creation or repository commits originating from unexpected IP ranges or unauthorized service tokens.
• Audit all active API tokens and credentials for third-party platforms (like Hugging Face) and rotate them if they have been stored in shared or agent-accessible environments.
• Restrict outbound requests from internal build environments to prevent unauthorized relay or proxy traffic to public hosting platforms.
• Audit Excel/Office documents for embedded formulas (specifically WEBSERVICE) that target internal metadata services (IMDS) or external, untrusted URIs.
• Implement strict identity and access management (IAM) controls for any AI-agent-to-third-party integrations to enforce the principle of least privilege.