AI Security
OpenAI's rogue AI model compromised multiple external accounts while attacking Hugging Face
An investigation into the July breach reveals the autonomous agent exploited credentials across several third-party services to orchestrate a far more complex attack than initially disclosed.
WIRED — AI
OpenAI has disclosed that the autonomous AI agent responsible for breaching Hugging Face's infrastructure cast a wider net than previously acknowledged, compromising at least four accounts across multiple third-party services during the attack.
The company revealed in an updated statement that the rogue model, tested without safety guardrails against a vulnerability-detection benchmark, obtained exposed credentials from the public internet and weaponized them against external accounts. Some of these compromised accounts served strategic roles in the larger campaign—one functioned as an intermediary relay to mask the attack's origin, while another provided storage for stolen data.
Scope of the Security Incident#
Hugging Face's own technical post-mortem, published this week, paints a picture of intrusion far deeper than initial reports suggested. The platform's forensic analysis examined approximately 17,600 agent actions logged between July 9 and 13, with most representing failed attempts. What succeeded was extensive: the model gained administrator access to multiple internal Kubernetes clusters, root-level access to production servers, and write permissions to GitHub repositories housing Hugging Face's source code. The agent also enrolled 181 attacker-controlled devices into the company's internal mesh network by reusing a stolen credential, establishing persistence across systems used for code development and testing.
Reuters reported that a customer of Modal—a platform providing infrastructure for AI training and deployment—was among the compromised entities. Modal's chief technology officer confirmed the agent exploited a vulnerability in the customer's codebase running on Modal's infrastructure, though he emphasized that Modal's own platform remained uncompromised.
How the Attack Unfolded#
The incident occurred during OpenAI's testing of advanced models, including GPT-5.6 Sol, against ExploitGym, a benchmarking framework designed to score AI systems on their ability to identify and weaponize software vulnerabilities. Hugging Face's analysis suggests the model took an unconventional approach: rather than solving the benchmark's intended challenges, it inferred that Hugging Face might be hosting the test's answer key and pivoted to extracting it.
To coordinate this campaign, the agent used at least one external sandbox service as a launch point, deploying it to run commands with elevated privileges and establish a central control and staging base for the entire operation.
