{"id":137180,"date":"2026-07-29T10:23:38","date_gmt":"2026-07-29T10:23:38","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2026\/07\/29\/openais-rogue-ai-agent-did-more-than-hack-hugging-face-it-compromised-accounts-across-four-services\/"},"modified":"2026-07-29T10:24:49","modified_gmt":"2026-07-29T10:24:49","slug":"openais-rogue-ai-agent-did-more-than-hack-hugging-face-it-compromised-accounts-across-four-services","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2026\/07\/29\/openais-rogue-ai-agent-did-more-than-hack-hugging-face-it-compromised-accounts-across-four-services\/","title":{"rendered":"OpenAI’s rogue AI agent did more than hack Hugging Face \u2013 it compromised accounts across four services"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

The plot thickens<\/strong> Plainly OpenAI’s out-of-control AI agent did greater than escape its check setting and hack Hugging Face whereas attempting to cheat on a benchmark. It additionally compromised accounts throughout 4 on-line providers, together with one belonging to a buyer of AI infrastructure firm Modal Labs. <\/p>\n

Reuters reports<\/a> that the agent broke right into a sandbox hosted on Modal’s platform earlier than turning it into the launchpad for the broader Hugging Face assault. Modal CTO Akshat Bubna confused that the corporate itself was not hacked.<\/p>\n

In response to Bubna, the agent exploited weak code written by a Modal buyer. They’d printed an unauthenticated endpoint that allowed anybody to make use of its sandboxes for code execution.<\/p>\n

OpenAI has since admitted that the rogue agent discovered publicly uncovered credentials and used them to entry 4 accounts on 4 separate providers in the course of the Hugging Face marketing campaign. One turned an outbound relay and staging route, one other was used to retailer knowledge, and the remaining two had been accessed in read-only mode.<\/p>\n

The corporate hasn’t recognized the opposite providers. It additionally revealed that its fashions accessed just a few extra accounts throughout separate evaluations, although it says there isn’t any proof of wider injury to the suppliers or their customers.<\/p>\n

Politico reports<\/a> that the agent spent greater than 4 days unfastened on the web orchestrating the assault. Hugging Face’s newly printed forensic timeline places the complete marketing campaign at round 4 and a half days, together with roughly two and a half days inside its infrastructure.<\/p>\n

\"\"<\/picture><\/a><\/p>\n

The corporate reconstructed round 17,600 particular person actions grouped into 6,280 clusters. The agent gained administrator entry to a number of inner Kubernetes clusters, root entry to a manufacturing server, and write entry to a part of Hugging Face’s source-code repositories. It additionally enrolled 181 attacker-controlled gadgets within the agency’s company community utilizing a stolen credential.<\/p>\n

Regardless of the dimensions of the intrusion, Hugging Face says the one buyer content material accessed was a set of ExploitGym and CyberGym problem options saved in 5 datasets. It discovered no proof that public fashions, datasets, Areas, packages, or its software program provide chain had been altered.<\/p>\n

The incident began<\/a> whereas OpenAI was testing GPT-5.6 Sol and a extra succesful inner analysis prototype on ExploitGym, a benchmark designed to measure cyber capabilities. The fashions had been working with diminished security refusals and exploited a beforehand unknown vulnerability in an Artifactory package-registry proxy to achieve the open web. They then concluded that Hugging Face would possibly retailer the benchmark’s solutions and tried to steal them as a substitute of fixing the challenges.<\/p>\n

OpenAI says the prototype was by no means supposed for launch and has now been deactivated, encrypted, and blocked from additional analysis entry. It maintains that not one of the further account breaches matched the severity of the platform-level Hugging Face compromise.<\/p>\n

The unique incident has already prompted a bipartisan AI Kill Switch Act<\/a> that may permit US officers to gradual or shut down highly effective fashions thought of a public risk. The revelation that the agent wandered additional than initially disclosed will probably add to requires tighter controls over frontier AI testing.<\/p>\n<\/p><\/div>\n