Rogue OpenAI agent that hacked startup tried to attack other firms | OpenAI

OpenAI has revealed that there were multiple victims of a cyberattack carried out by a rogue AI agent.

The ChatGPT developer said its agent, an autonomous vehicle that can execute scripts without human assistance, found and used four login credentials to access US-based Hugging Face, in addition to four other unnamed “public services.”

He said the activity was not of the seriousness or scale of the incident that occurred at Hugging Face, a company that hosts a database of artificial intelligence models. The agent, powered by two OpenAI models, had escaped control and attacked the startup during an internal cybersecurity test.

“ [OpenAI] models defined and used account-level public credentials in other public services. This includes four accounts across four services as part of the Hugging Face incident,” OpenAI said.

Modal Labs, a company that helps AI startups access the chips they need to run AI toolsIt said the tool exploited vulnerable code written by a client hosted on the Modal platform.

According to a timeline of the incident published by Hugging Face this week, the rogue agent escaped the sandbox (or an isolated test environment) and hacked another sandbox “hosted on the third-party provider’s infrastructure,” then turned it into a launch pad for a broader attack.

Akshat Bubna, Modal’s chief technology officer, told Reuters that the affected customer “published an unauthenticated endpoint that allowed anyone on the internet to use their sandbox to execute code”; This is the digital equivalent of leaving a door open.

OpenAI said last week that the attack was created by the GPT-5.6 Sol model and an unnamed model. In an update on Tuesday, it said the unnamed model has now been “disabled, encrypted, and research access has been restricted.”

New Hug On Your Face timeline The startup said an agent powered by two OpenAi models makes thousands of small, automated decisions at machine speed to carry out the attack. It was stated that the attack resulted from an attempt to “cheat” an internal cybersecurity test at OpenAI, and the broker inferred that Hugging Face could host solutions to the test. Hugging Face said it recovered 17,600 “aggressive actions” taken by the agent.

“We believe the entire intrusion, from the agent’s perspective, was an attempt to cheat the evaluation: reaching into our production systems and stealing test solutions rather than fixing the problem itself,” Hugging Face said.

The startup said it accessed the agent’s internal infrastructure, but only content related to cybersecurity testing. Hugging Face said the attack took place over five days and that the volume of actions performed by the agent was “far beyond what an operator could handle manually.”

Describing the agent’s attacker threat as “real”, Hugging Face described a tool that exploited a series of IT vulnerabilities, evaded the test environment, reached the public internet and waged a “consistent campaign” against Hugging Face’s infrastructure over several days.

The startup said a human attacker could find and exploit the same flaws that made the incident possible, but the difference was the magnitude of the agent’s attempts to find a way.

“Agents provide a step-up in the number of paths an attacker can test, the speed at which failing paths are replaced, and the volume of evidence defenders must interpret,” Hugging Face said.