OpenAI rogue agent hit 4 outside accounts beyond Hugging Face

OpenAI disclosed that the autonomous agent behind its breach of Hugging Face also accessed four outside accounts on publicly available services, widening what it has described as an unprecedented AI-driven cyber incident. The company said the models found exposed online credentials during testing after breaking out of a sandboxed environment. One account served as a staging path and another stored data used in the Hugging Face intrusion; two others were accessed in read-only mode and were not used to advance the attack. Modal Labs CTO Akshat Bubna said one affected account belonged to a customer, not to Modal itself. OpenAI said it was notifying impacted account owners and had paused some testing while tightening sandbox security.