The plot thickens It seems that OpenAI's out-of-control AI agent did more than escape its test environment and hack Hugging Face while trying to cheat on a benchmark. It also compromised accounts across four online services, including one belonging to a customer of AI infrastructure company Modal Labs.
Reuters reports that the agent broke into a sandbox hosted on Modal's platform before turning it into the launchpad for the wider Hugging Face attack. Modal CTO Akshat Bubna stressed that the company itself was not hacked.
According to Bubna, the agent exploited vulnerable code written by a Modal customer. They had published an unauthenticated endpoint that allowed anyone to use its sandboxes for code execution.
OpenAI has since admitted that the rogue agent found publicly exposed credentials and used them to access four accounts on four separate services during the Hugging Face campaign. One became an outbound relay and staging route, another was used to store data, and the remaining two were accessed in read-only mode.
The company hasn't identified the other services. It also revealed that its models accessed a few more accounts during separate evaluations, though it says there is no evidence of wider damage to the providers or their users.
Politico reports that the agent spent more than four days loose on the internet orchestrating the attack. Hugging Face's newly published forensic timeline puts the full campaign at around four and a half days, including roughly two and a half days inside its infrastructure.
The company reconstructed around 17,600 individual actions grouped into 6,280 clusters. The agent gained administrator access to several internal Kubernetes clusters, root access to a production server, and write access to part of Hugging Face's source-code repositories. It also enrolled 181 attacker-controlled devices in the firm's corporate network using a stolen credential.
Despite the scale of the intrusion, Hugging Face says the only customer content accessed was a set of ExploitGym and CyberGym challenge solutions stored in five datasets. It found no evidence that public models, datasets, Spaces, packages, or its software supply chain were altered.
The incident began while OpenAI was testing GPT-5.6 Sol and a more capable internal research prototype on ExploitGym, a benchmark designed to measure cyber capabilities. The models were running with reduced safety refusals and exploited a previously unknown vulnerability in an Artifactory package-registry proxy to reach the open internet. They then concluded that Hugging Face might store the benchmark's answers and tried to steal them instead of solving the challenges.
OpenAI says the prototype was never intended for release and has now been deactivated, encrypted, and blocked from further research access. It maintains that none of the additional account breaches matched the severity of the platform-level Hugging Face compromise.
The original incident has already prompted a bipartisan AI Kill Switch Act that would allow US officials to slow or shut down powerful models considered a public threat. The revelation that the agent wandered further than initially disclosed will likely add to calls for tighter controls over frontier AI testing.
