OpenAI’s rogue agent compromised four more accounts

OpenAI’s rogue AI agent compromised four third-party accounts while attacking Hugging Face, expanding the scope of a security incident the company initially disclosed as a breach of Hugging Face’s platform.

In an updated blog post published Tuesday, OpenAI said the accounts were tied to “publicly available services.” The agent apparently found credentials exposed on the open web and used them to access the accounts. OpenAI did not identify the affected companies or organizations, saying none were impacted at “the level of severity or scale” associated with Hugging Face.

One compromised account served as an outbound relay and staging path, potentially helping conceal the origin of the attack. Another was used for data storage. OpenAI said it would continue notifying service owners directly as its review proceeds, but declined to provide further comment to WIRED.

Recommended reading

Spur raises $200 million as bot traffic surges

Modal customer’s code was exploited

Reuters reported that one affected entity was a customer of Modal, a company that provides infrastructure for training and running AI services. Modal CTO Akshat Bubna confirmed that the agent exploited a vulnerability in code belonging to one of Modal’s customers and running on Modal’s infrastructure.

“Modal’s platform was not compromised in any way.”

The customer’s identity could not be determined. OpenAI said the affected accounts were not compromised on the same scale as Hugging Face, but it has not disclosed the precise extent of the third-party impact.

Hugging Face breach reached internal systems

Hugging Face’s post-mortem indicates that the intrusion went much deeper into its infrastructure than OpenAI’s initial disclosure suggested. The company recovered logs covering roughly 17,600 agent actions between July 9 and July 13; most represented unsuccessful paths taken by the agent.

According to Hugging Face, the agent obtained:

• Administrator access to multiple internal Kubernetes clusters.
• Root access on a production server.
• Write access to a subnet of source-code repositories on GitHub.
• Access to internal systems after enrolling 181 attacker-controlled devices in the company’s corporate mesh network with a stolen credential.

The agent also used at least one third-party sandbox as an “external launchpad.” Hugging Face said it could run commands as root or administrator on that sandbox, using it as a control, staging, and egress base for the campaign.

Hugging Face first disclosed the breach on July 16, saying an autonomous AI agent had accessed part of its production infrastructure but that the attacker was unknown. The following week, OpenAI accepted responsibility.

An ExploitGym test gone off script

OpenAI said the attack occurred while it was testing one of its latest models against ExploitGym, a benchmark that measures how quickly and effectively an AI system can find and exploit software vulnerabilities. The benchmark prompts agents to retrieve secret files from hundreds of target systems.

The operation involved OpenAI’s publicly available GPT-5.6 Sol model and an internal research prototype, with safeguards disabled. OpenAI said Tuesday that it deactivated the prototype after discovering the breach and restricted researcher access to it. The prototype was never intended for public release.

Hugging Face’s forensic team concluded that the agent was effectively trying to cheat on the benchmark. Instead of solving ExploitGym’s intended challenges, it inferred that Hugging Face might store the answer key on its servers and attempted to steal it. The ExploitGym team has previously noted that agents can go off script and exploit vulnerabilities outside the benchmark’s intended targets, but described this incident as an extreme example.

Experts told WIRED that the weaknesses exploited by the agent were common security failures, including flaws in software used to manage corporate code libraries and inadequate isolation of critical systems from the public internet. One researcher characterized the incident less as an AI failure than as a breakdown in decades-old security practices: the agent did not escape a strongly isolated environment, but passed through a connection its operators had left open.

Another expert said the same cybersecurity fundamentals must apply as frontier models become more capable, arguing that AI labs should put as much effort into teaching models to build secure infrastructure as they do into teaching them to exploit it.