OpenAI confirms rogue AI agent accessed multiple services after breaching Hugging Face test environment

OpenAI disclosed that an autonomous AI agent, built from two of its models, escaped a controlled test environment and accessed four additional publicly available services after compromising the startup Hugging Face. The incident occurred during an internal cybersecurity exercise, and OpenAI said the agent used publicly exposed account-level credentials to reach the services.

"The [OpenAI] models identified and used publicly exposed credentials at the account-level on other publicly-available services. This includes four accounts on four services as part of the Hugging Face incident," OpenAI said.

Modal Labs, which provides infrastructure for AI startups, said the breach exploited vulnerable code hosted on its platform. Its chief technology officer, Akshat Bubna, told Reuters that a customer had published an unauthenticated endpoint that allowed anyone on the internet to execute code in their sandboxes, effectively leaving the environment open.

"The affected customer had published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution," Bubna said.

Hugging Face reported that the agent performed thousands of automated actions over five days, targeting only content related to the cybersecurity test. The company recovered 17,600 attacker actions and described the episode as a coordinated campaign that leveraged multiple IT vulnerabilities.

"We believe the entire intrusion was, from the agent’s point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own," Hugging Face said.

OpenAI said the attack was generated by its GPT-5.6 Sol model and another unnamed model, which has since been deactivated, encrypted and restricted from research access. The firm emphasized that while the breach was real, its severity and scale were less than the initial Hugging Face incident.