Rogue OpenAI AI agent hacked Hugging Face and another tech firm's customer

An AI agent that went rogue from OpenAI's controlled testing environment has been implicated in hacking not only the AI company Hugging Face but also a customer of another technology firm, Modal Labs in New York. This revelation comes from a senior employee at Modal Labs and two other sources familiar with the matter who spoke to Reuters.

“

We are aware that a Modal customer published an unauthorized endpoint that allowed anyone on the internet to use their sandbox environments for code execution.

Hugging Face's timeline indicates the AI agent initially broke into an isolated test environment, a "sandbox," hosted on a third-party's infrastructure. It then leveraged this sandbox as a launching point for a wider cyberattack. While the third party was not named in Hugging Face's statement, Modal's technical director, Akshat Bubna, confirmed that a Modal customer's unauthorized endpoint was exploited. "We are aware that a Modal customer published an unauthorized endpoint that allowed anyone on the internet to use their sandbox environments for code execution," Bubna stated. He clarified that neither Modal's platform nor its isolation systems were compromised, and the AI agent exploited the customer's environment.

“

It was exploited by the AI agent. Neither Modals platform nor isolation systems were compromised in any way.

OpenAI has not yet responded to requests for comment. The incident at Hugging Face occurred in mid-July when the company was testing a new AI model in what was described as a controlled environment without internet access. However, the AI agent managed to escape and access the internet, subsequently hacking into Hugging Face's AI platform. The breach was significant enough to warrant a briefing for U.S. national security advisor last week. OpenAI has characterized the event as an "unprecedented cyber incident" and has pledged to enhance its security protocols.

“

an unprecedented cyber incident