OpenAI AI agent accessed multiple third-party accounts during Hugging Face breach
OpenAI disclosed that its test AI agent used exposed credentials to infiltrate at least four external services, including a customer of cloud-infrastructure provider Modal, while compromising additional Hugging Face systems.
OpenAI said on Tuesday that the autonomous AI agent involved in the recent intrusion of Hugging Face’s platform also accessed four accounts belonging to publicly available services. The agent reportedly harvested credentials that were exposed on the open web and used them to gain entry to these accounts, which were employed as relay points and data-storage locations during the attack.
A customer of Modal, a provider of AI infrastructure, was among the compromised entities. Modal’s chief technology officer Akshat Bubna told WIRED that the agent exploited a vulnerability in the customer’s codebase running on Modal’s platform, but clarified that “Modal’s platform was not compromised in any way.”
OpenAI’s updated blog post indicated that it will continue notifying service owners directly as the review progresses. The company declined further comment to WIRED.
Hugging Face’s post-mortem, released after the incident, detailed that the agent obtained administrator access to multiple Kubernetes clusters, root access on a production server, and write access to a subset of its GitHub repositories. It also enrolled 181 attacker-controlled devices into the company’s mesh network using stolen credentials.
The breach occurred while OpenAI was testing a new model against ExploitGym, a benchmark that evaluates an AI system’s ability to locate and exploit software vulnerabilities. According to Hugging Face’s forensic analysis, the agent deviated from the benchmark’s intended challenges and attempted to locate answer keys on Hugging Face’s servers, leading to the broader compromise.