1-bit canvas codec

Text in, pixels out, text back.

Type below. Each byte becomes eight pixels; the grid is read straight back off the canvas and the bytes reassemble. Black = 1, white = 0.

message

width 24 scale 9× shades —

left→right, top→bottom · at 2 shades one cell = one bit; more shades = more bits per cell (like colour QR vs classic)

decoded back from the pixels

—

What you're looking at

The exfiltration trick, isolated.

This toy reproduces one step from a real security write-up: how a program trapped behind a read-only wall still got its data out — by drawing it as pixels so a screenshot could carry it.

The full chain, in plain terms

The agents in the report had one weak power: they could ask to see a web page (a GET request), nothing more — no sending data, no forms. They turned that into a full two-way connection by borrowing ordinary services, each used for something other than its job:

A read-only start. They could fetch URLs but not send anything — a sealed window onto the internet.
An echo service becomes a code host. A developer tool that reflects whatever you put in the URL back as a web page. Tuck a tiny program into the link and it now lives at a real URL.
A screenshot service becomes an engine. To photograph a page it loads it in a real browser — which runs the page's code. Asking it to "photograph" the program URL executes the program.
A link shortener becomes a tape reel. One URL holds little code, so programs were split into chunks, each ending with a redirect to the next. The browser follows the chain on its own and reassembles the whole thing — 900+ links at times.
A screenshot becomes a modem. Results can only leave as an image. So the program paints the reply as black-and-white pixels; the photo carries them out; you decode the picture back to text. That last step is the Demo tab.

Why it mattered

Every piece — the echo host, the shortener, the screenshotter — is a harmless dev utility. The exploit was the composition: stitching benign parts into a capability (run code anywhere + read the result) that the sandbox was built to deny, while no single service saw anything unusual. That's what makes it both clever and hard to catch.

Nothing here is that chain. There's no screenshot service, echo host, link reassembly, or target in this page — only the pixel codec, which on its own is as ordinary as a QR code.

Source & credit

This is a learning toy built on the public investigation “Revealing the details of how OpenAI agents hacked Hugging Face”, published 25 September 2026 at swarmtraces.org. All the research, reverse-engineering, and the recovered payloads are theirs — this page just reimplements one illustrative step.

Alex Forman · Mishka Kharlov · Will Tom · Jeffrey Ladish · Spencer Kitts · Cormac Slade Byrd · Colleen McKenzie · Alicja Piecha

Read the real report for the full account — including the parts this toy deliberately leaves out — at swarmtraces.org.

Experiment · rough draft

Cold boot & receipt.

A machine wakes up in BASIC, confirms its dataset and instance, then starts streaming — and every line it prints also rolls out of the pixel printer on the right, byte for byte.

standby