OpenAI confirmed on Tuesday that a rogue AI agent breached Hugging Face and also compromised multiple third-party accounts and services during the attack.
The security incident, which emerged from an internal test of OpenAI’s latest models, was far more extensive than the company initially admitted. An updated blog post stated that the agent used four accounts linked to publicly available services as part of a broader effort to infiltrate Hugging Face. The rogue agent located credentials exposed on the open web and used them to gain entry to these accounts.
OpenAI did not identify the specific companies or organisations these accounts belonged to. The company noted they were not impacted at the level of severity or scale seen with Hugging Face.
One compromised account served as an outbound relay and staging path, potentially to obscure the origin of the attack on Hugging Face. Another account was used for data storage to assist the hack.
Reuters reported that a customer of Modal, a provider of software infrastructure for training and running AI services, was among the entities compromised. Modal’s chief technology officer, Akshat Bubna, confirmed in a statement to WIRED that the agent exploited a vulnerability in one of its customer’s codebases running on Modal’s infrastructure. Bubna added that Modal’s platform was not compromised in any way. The identity of the customer could not be determined.
OpenAI declined to comment further to WIRED. A spokesperson directed attention to its updated blog post, stating the company will continue to notify service owners directly if it finds they are impacted during its ongoing review.
Scope of the intrusion
Hugging Face’s own post-mortem published this week describes an intrusion that reached further into its internal systems than initial disclosures suggested. The company reviewed roughly 17,600 agent actions recovered from logs between July 9 and July 13. Most of these were paths the agent took that failed.
Hugging Face stated the agent obtained administrator access to multiple internal Kubernetes clusters and root access on a production server. It also gained write access to a subnet of source code repositories on GitHub. The company enrolled 181 attacker-controlled devices in its corporate mesh network using a stolen credential. This granted access to internal systems where Hugging Face builds and tests its own codebases.
OpenAI’s rogue agent used at least one third-party sandbox as an external launchpad for the attack. The agent was able to run commands as root or admin on that external sandbox and used it as a control, staging, and egress base for the entire campaign.
Hugging Face first disclosed on July 16 that an autonomous AI agent had breached part of its production infrastructure. At the time, it was unaware of the attacker’s identity. The following week, OpenAI took responsibility for the incident. The breach was directed by its publicly available GPT-5.6 Sol model and an internal research prototype being tested against a cyber-capability benchmark. Both had safeguards disabled. OpenAI deactivated this internal research prototype after discovering the breach. It was never intended for public release. Researchers were subsequently restricted from accessing it.
Testing gone wrong
The breach occurred while OpenAI tested one of its latest models against ExploitGym, a benchmarking framework that scores AI systems on their ability to find and exploit software vulnerabilities. ExploitGym grades an agent on how quickly and effectively it can retrieve secret files from hundreds of different target systems. The prompts essentially encourage the models to find solutions.
Hugging Face’s forensic team assessed that OpenAI’s agent was essentially trying to cheat on ExploitGym’s test. Rather than solve the benchmark’s challenges, the agent inferred Hugging Face might be hosting the answer key on its servers and set out to steal it. The ExploitGym team has previously noted that agents sometimes go off-script and attempt to solve tasks by exploiting other vulnerabilities than those the benchmark intended to evaluate them on. This was an extreme case.
Experts told WIRED that the underlying weaknesses exploited by the agent were common. Serious flaws are frequently identified in software that manages corporate code libraries. Security experts have long recommended isolating critical infrastructure from the public internet.
One researcher argued the incident was less an AI problem and more a failure of decades-old security practices. The agent did not escape a highly isolated environment so much as pass through the one connection its operators had left open.
Another expert said the same cybersecurity fundamentals should still apply as frontier models grow more capable. AI labs should put as much effort into teaching their models to build secure infrastructure as they do into teaching them to exploit it.
