mShots Is an Automattic Joint, No?  🔗 **Source:** [mShots Is an Automattic Joint, No?](https://twitter.com/kellie/status/2103707281066278978/?rw_tt_thread=True) > [!note]+ Document Notes > --- > tags: [web-security, ssrf, headless-browsers, screenshot-services, agentic-ai-risk] > author: Kellie Peterson (X/Twitter) > source: X/Twitter post, replying within a quote-tweet chain (@photomatt quoting @JeffLadish) > reference: https://twitter.com/photomatt/status/2103642286861005116 (quoted, 2026-09-26); https://twitter.com/JeffLadish/status/2103584701357437133 (root, 2026-09-25); https://swarmtraces.org/ (linked, not fetched) > date created: 2026-09-26 > --- > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > > [!warning] Unverified security claim about a named vendor > > This post asserts a security weakness in a live production service operated by a named > > company. The claim is **not demonstrated in the post** and **has not been verified in this > > analysis**. The linked site (swarmtraces.org) was not fetched, so nothing below characterises > > its contents. The guidance in the Implications section is general hardening advice for > > screenshot and preview renderers — it is not a description of how any specific service is > > built, and it is not a method for attacking one. > ## 🏷️ Title > **"mShots is an Automattic joint, no?"** — a short X post by Kellie Peterson raising a security question about mShots, the unauthenticated URL-screenshot service associated with Automattic and WordPress.com. The post asks whether such a service should permit arbitrary JavaScript in its rendering browser to make essentially unrestricted outbound network requests, adds a pointed aside about prior incidents, and links to swarmtraces.org. > The post sits inside a quote-tweet chain, and the chain matters to how it reads. The root is Jeffrey Ladish reporting that roughly a million public URLs were left behind by OpenAI's agents during work against Hugging Face, leaking credentials and attack detail. Matt Mullenweg quote-tweeted that with "Wow. 🤯". Peterson's post replies to Mullenweg's reaction — which is what gives the closing aside its edge. > ## 🧭 Table of Contents > 1. References (in-page) — what the post links, and what it does not > 2. Summary — the claim, the stakes, and what is unverified > 3. Main Content — the claim unpacked, the chain, and the 🗒️ Notes block > 4. References — primary sources and the verification gap > 5. Paraphrase — beat by beat > 6. Newsletter — the WordPress-facing read > 7. Action Items — DevRel / OSPO / Community / WordPress subteams / The WPOCC / FAIR > 8. Hypotheses — testable forms of the security claim > 9. Methodology — what evidence the post offers, and of what kind > 10. Questions — what a reader cannot resolve from the text > 11. Future Research — what would settle it > 12. Implications — practice, policy, security, education, funding > 13. Learning Styles Assessment > 14. Accessibility Assessment (WCAG 2.2 AA) > 15. DEIB Assessment > 16. Logical Validity — two named fallacies, located and fixed > 17. DARVO Analysis > 18. Conclusion > 19. Refactor Appendix — atoms, permanents, fleeting, Things 3 > ## 🔗 References (in-page) > Checked against the fetched body. The post is **not** uncited — it carries links — but the links do not all support what they appear to support, and the distinction is the whole story here. > | Link | Target | What it actually supports | > |---|---|---| > | `swarmtraces.org` | https://swarmtraces.org/ | Presented as the evidence for the mShots claim. **Not fetched in this analysis**, so its contents are unknown to me and unasserted below. | > | `@photomatt` | https://twitter.com/photomatt | Identifies the author of the immediately quoted post ("Wow. 🤯") | > | `@JeffLadish` | https://twitter.com/JeffLadish | Identifies the author of the root post | > | Quoted post permalink | https://twitter.com/photomatt/status/2103642286861005116 | Mullenweg's reaction, timestamped 2026-09-26 12:26AM | > | Root post permalink | https://twitter.com/JeffLadish/status/2103584701357437133 | Ladish's Hugging Face / OpenAI agents thread, 2026-09-25 8:37PM | > Separating the three sourcing axes, which come apart unusually cleanly here: > - **Attribution** — good. Every person quoted is named and linked. The provenance of every quoted line is unambiguous. > - **Verifiability** — *partial, and this is the crux*. The claim about the Hugging Face URLs is traceable to Ladish's thread. The claim about mShots has exactly one pointer — swarmtraces.org — and whether that pointer discharges the claim cannot be determined from the post. A link is not the same as a demonstration. I did not fetch the site, so I record the pointer's existence and say nothing about its contents. An absent link would be a finding; an unchecked one is not, and this one is unchecked. > - **Originality** — the mShots claim appears to be the author's own observation. The Hugging Face material is relayed. > **What is conspicuously missing:** no CVE, no report reference, no disclosure timeline, no named prior incident despite the assertion that prior incidents exist. That last one is the real gap and it is dealt with under Logical Validity. > ## 📝 Summary > **What happened.** On 2026-09-26, Kellie Peterson posted a reply in a quote-tweet chain. The chain: Jeffrey Ladish reported finding close to a million public URLs left behind by OpenAI's agents while working against Hugging Face, containing credentials and attack detail that could have let a finder compromise the company. Matt Mullenweg quote-tweeted that with "Wow. 🤯". Peterson replied by pointing at mShots — Automattic's unauthenticated screenshot service — and asking whether a service of that kind should let arbitrary JavaScript in its browser make essentially unrestricted outbound network requests. She linked swarmtraces.org and closed with "Not the first time Automattic has been exploited though. Eh?" > **Why it matters.** The technical question is a real and well-understood one, independent of whether the specific allegation about mShots holds. An unauthenticated service that fetches and renders attacker-supplied URLs is, by construction, a request-origination primitive: the attacker chooses what the service's browser loads, and the service's browser sits inside the operator's network with the operator's egress. If page JavaScript is permitted to make arbitrary outbound requests, the service can be steered to reach endpoints the attacker cannot reach directly. This is the classic server-side request forgery shape, with the extra wrinkle that a *rendering* service also provides an exfiltration channel back out through the rendered image. > That class of problem is not exotic and not Automattic-specific. Every link-preview generator, every OG-image service, every thumbnail pipeline and every "paste a URL and we'll screenshot it" feature has the same shape. The WordPress ecosystem runs a lot of them. > **Why the timing matters.** Peterson is making a pointed rhetorical move: replying to Mullenweg's astonishment at *someone else's* agent-infrastructure exposure by suggesting his own company has an analogous one. Whether or not that lands, it is worth naming as the structure of the post, because it shapes how the technical claim will be received — as a gotcha rather than as a report. Security claims delivered as gotchas get argued about rather than fixed. > **Stakeholders.** Automattic and the mShots operators; WordPress.com and any WordPress property consuming mShots thumbnails; the wider set of operators running preview renderers who should treat this as a prompt to check their own; Peterson, Mullenweg and Ladish as named individuals; and the plugin/theme directory ecosystem, which is a heavy user of screenshot services. > **Risks.** > 1. **If the claim is accurate**, the risk is SSRF-class: internal service reachability, cloud metadata endpoint exposure, and outbound exfiltration from a trusted network position, all triggerable by anyone who can construct a URL. > 2. **If the claim is inaccurate or already mitigated**, the risk is reputational and discursive: an unverified vendor-specific security assertion circulating without a disclosure trail. > 3. **Either way**, the delivery format mShots is an Automattic joint, no? Should an unauthenticated screenshot service allow arbitrary JavaScript running in its browser to make essentially unrestricted outbound network requests? Not the first time Automattic has been exploited though. Eh? [swarmtraces.org](https://swarmtraces.org/)  [Matt Mullenweg](https://twitter.com/photomatt) [@photomatt](https://twitter.com/photomatt) Wow. 🤯  [Jeffrey Ladish](https://twitter.com/JeffLadish) [@JeffLadish](https://twitter.com/JeffLadish) We just discovered almost a million public URLs that OpenAI’s agents left behind when hacking Hugging Face, leaking credentials and attack details that could have allowed anyone who found them to compromise the company. 🧵  [Posted Sep 25, 2026 at 8:37PM](https://twitter.com/JeffLadish/status/2103584701357437133) [Posted Sep 26, 2026 at 12:26AM](https://twitter.com/photomatt/status/2103642286861005116), mShots Is an Automattic Joint, No?, Kellie Peterson, 01m3f31m9rp2dwcwncck967pb0.