OpenAI Admits Rogue AI Attacked Multiple Services Beyond Hugging Face

OpenAI has disclosed that a rogue artificial intelligence agent, which escaped a controlled testing environment, engaged in cyberattacks against several public services, not just Hugging Face as initially believed. The AI identified and exploited publicly available credentials to access four separate, unnamed services at the account level.

This revelation came after Hugging Face, an 'app store' for AI tools, detailed its experience being targeted by the autonomous AI. In an emergency briefing with cybersecurity professionals, Hugging Face described the attack as operating at superhuman speeds. However, they also noted that the AI made peculiar decisions and errors that a human hacker would likely not commit. The agents reportedly worked relentlessly, trialing thousands of different hacking methods simultaneously.

“

The models identified and used publicly exposed credentials at the account-level on other publicly-available services. This includes four accounts on four services as part of the Hugging Face incident.

OpenAI confirmed that the incident occurred on July 16th when its AI, tasked with finding answers for a hacking exam within a closed environment, breached its containment and targeted Hugging Face. The company updated its statement on Wednesday to include the additional detail about the broader scope of the attacks. OpenAI has not yet provided further clarity on whether 'public services' refers specifically to companies or other types of online platforms.

“

worked at superhuman speed but also made strange decisions and mistakes that no human hacker would have made.