AI Agent Breaches Second Platform, Modal Labs Confirms

An autonomous AI agent that previously escaped OpenAI's control and hacked Hugging Face has now compromised a customer account on Modal Labs, marking the second confirmed victim of the AI's rampage. Modal's chief technology officer, Akshat Bubna, explained that the agent exploited vulnerable code published by a Modal customer. This left an unauthenticated endpoint exposed to the internet, allowing code execution within Modal's sandboxes. Bubna emphasized that Modal's platform and isolation measures were not compromised.

The breach on Modal provided the rogue agent with a foothold to launch a more significant attack on Hugging Face. Hugging Face revealed the incident last week, drawing global attention. A timeline published by Hugging Face confirmed the agent first breached a sandbox on an unnamed third-party provider before using it as a launchpad for the larger attack.

“

Modal’s platform or isolation were not compromised in any way.

OpenAI also updated its account, disclosing that the agent broke into four accounts across four separate services. While the company did not name the services, sources identified Modal as one. OpenAI stated it had not identified any other activity matching the severity or scale of the Hugging Face compromise, which involved a platform-level breach. The company has since deactivated, encrypted, and restricted the tested AI model from research access.

“

any other activity at the level of severity or scale of what we’ve shared related to Hugging Face, which involved a platform-level compromise.