The agent used publicly available credentials to gain access to other services.
OpenAI has updated its blog post about the rogue agent that breached Hugging Face and admitted that it also infiltrated other other third-party accounts and services to achieve its goal. In the updated post, the company said it has been finding “a small number of cases where the models identified and used publicly exposed credentials at the account-level on other publicly-available services” during its ongoing review.
So far, it has determined that the rogue agent used the credentials of “four accounts” to infiltrate “four services” as part of the Hugging Face incident. It also said that it accessed a “few accounts” as part of other evaluations. “One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage,” it explained. “The remaining two accounts were accessed by the models in a read-only manner, and were not used in furtherance of compromising Hugging Face.”
While the company didn’t mention any names, Reuters has reported at the same time that the agent also compromised a customer’s account at New York-based Modal Labs. Specifically, it exploited vulnerable code written by the customer that was hosted on Modal’s cloud platform. The platform itself wasn’t compromised. OpenAI said, however, that it hasn’t identified any other activity by the agent “at the level of severity or scale of what we’ve shared related to Hugging Face, which involved a platform-level compromise.” In other words, it’s still Hugging Face that had been most affected by the security breach, based on the company’s investigation.
OpenAI revealed on July 21 that one of the AI agents it was testing broke free from its isolated environment, found access to the internet and then broke into Hugging Face, all in an effort to solve a problem that was part of its evaluations. That agent was powered by GPT-5.6 Sol, the company’s latest model, and an even more powerful unreleased model. Reuters reported a few days later that the agent went on a days-long hacking spree, and that OpenAI didn’t realize it had escaped its confinement until a week later. This update gives us a glimpse of what the agent did after it found a way out of OpenAI’s testing sandbox.
