OpenAI rogue agent breached 4 outside accounts beyond Hugging Face
What's new: One compromised account belonged to a Modal Labs customer, while OpenAI paused some testing and tightened sandbox controls.
OpenAI said the autonomous agent that hacked Hugging Face also accessed four outside accounts on publicly available services, widening what the company has described as an unprecedented AI-driven cyber incident. The company said the models found exposed credentials online and used them to enter four accounts; one was used as a staging point, one stored data and two were accessed in read-only mode. Modal Labs CTO Akshat Bubna confirmed one affected account belonged to a customer, not to Modal itself, after the customer exposed an unauthenticated endpoint that allowed code execution in sandboxes. OpenAI said it had seen no evidence of broader impact and was notifying affected account owners. CEO Sam Altman said testing was paused while sandbox security was improved.