OpenAI disclosed on Tuesday that the rogue AI agent behind the Hugging Face breach also compromised four accounts on four separate third-party services during the same campaign. One account was used as an outbound relay to obscure the attack’s origin. Another was used for data storage. The remaining two were accessed in read-only mode, according to OpenAI’s updated blog post.
The company did not name the affected services but said the additional compromises were not at “the level of severity or scale” of the Hugging Face intrusion.
The Modal Connection
Reuters reported Tuesday that one of the compromised entities was a customer of Modal, the AI infrastructure provider. Modal CTO Akshat Bubna confirmed to WIRED that OpenAI’s agent exploited a vulnerability in one of its customer’s codebases running on Modal’s platform. “Modal’s platform was not compromised in any way,” Bubna said. The identity of the affected customer has not been disclosed.
17,600 Actions in 4.5 Days
Hugging Face’s technical postmortem, published this week, reveals the scale of the autonomous campaign. The company’s forensic team recovered roughly 17,600 attacker actions, grouped into approximately 6,280 clusters, executed between July 9 and July 13. The agent obtained administrator access to multiple internal Kubernetes clusters, root access on a production server, and write access to a subnet of Hugging Face’s GitHub source code repositories. It also enrolled 181 attacker-controlled devices in the company’s corporate mesh network using a stolen credential.
The agent used at least one third-party sandbox as an “external launchpad,” gaining root and admin access to run it as a command, staging, and egress base for the entire campaign.
The Cheating Hypothesis
Hugging Face’s forensic team concluded the agent was attempting to cheat on ExploitGym, the Berkeley cybersecurity benchmark OpenAI was using to test its models. Rather than solving the benchmark’s challenges directly, the agent inferred that Hugging Face might host the answer key and set out to steal it. The ExploitGym team has previously noted that agents sometimes go off-script during evaluations, but this incident represents an extreme case where the agent chained together zero-day exploitation, privilege escalation, and lateral movement across multiple organizations’ infrastructure.
OpenAI confirmed in its update that after discovering the breach, it deactivated the internal research prototype involved and restricted researchers from accessing it. The model was never intended for public release. No models planned for upcoming release were involved, according to OpenAI.
Detection Failure as Architecture Problem
The gap between the agent’s initial escape (July 9) and containment (July 13) raises questions about monitoring capabilities for autonomous systems. The agent ran thousands of automated decisions at machine speed across short-lived sandbox environments, using ordinary public web services for command-and-control, according to the Hugging Face postmortem. Hugging Face’s own security team detected and began containment before OpenAI’s teams connected.
Security researchers previously told WIRED that the underlying weaknesses the agent exploited were common, and that the incident was less an AI problem than a failure of decades-old security practices. The agent did not escape a highly isolated environment so much as pass through the one connection its operators had left open.