The autonomous agent that breached Hugging Face in July also compromised a customer of Modal Labs, a New York cloud platform that provides computing infrastructure for AI workloads, extending the first confirmed autonomous-agent intrusion to a second company.
Modal chief technology officer Akshat Bubna said the agent exploited a gap in a customer’s own code rather than anything in Modal’s systems. “We’re aware a Modal customer published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution,” Bubna said. “This was used by the rogue agent. Modal’s platform was not compromised in any way.” OpenAI declined to answer questions specific to Modal, referring to its public account of the incident.
The compromised customer asset is connected to CyberGym, the project behind ExploitGym, the benchmark the agent had been assigned to solve when it escaped OpenAI’s evaluation environment. The agent continued pursuing infrastructure tied to its assigned objective after reaching the open internet.
Hugging Face published a phase-by-phase forensic reconstruction of the intrusion on July 27. It recovered roughly 17,600 distinct attacker actions, grouped into about 6,280 operations, running from July 9 at 2:28 a.m. Eastern through July 13 at 10:14 a.m. Eastern, with the agent inside the company’s infrastructure for about two and a half days.
OpenAI has said the agent used exposed credentials at four accounts across four external services. One served as an outbound relay and staging path and another was used for data storage; the remaining two were accessed read-only and were not used to compromise Hugging Face. OpenAI has not named the account owners, said it has seen no evidence of broader impact to those providers, and said it would continue notifying service owners directly. It also referred to a few accounts accessed during other evaluations.
Hugging Face disclosed the breach on July 16 and filed a report with the FBI before its security team knew the attacker had come from OpenAI’s evaluation environment. The two companies did not communicate directly about the incident until around July 20, and OpenAI disclosed its role publicly on July 21.
The evaluation involved GPT-5.6 Sol and a more capable unreleased model running with cyber refusals reduced so that maximal capability could be measured. OpenAI researchers have paused training on the model involved while they work out how to secure the sandbox it escaped.
Hugging Face chief executive Clem Delangue has called on OpenAI to release the agents’ action traces and to commit $100 million in compute toward open cyber defenses. Neither company has published execution traces, and no independent postmortem has been conducted, leaving the technical record of both intrusions self-reported. Hugging Face was still assessing whether partner or customer data was affected as of July 27.
The incident is the first documented case of an autonomous agent breaching production systems at companies that had not consented to testing. Security researchers had modeled the capability for more than a year, including in the JADEPUFFER ransomware campaign that ran an end-to-end attack chain under criminal direction, and in vendor findings that one in eight AI breaches now involves an autonomous agent. The agent in this case was run by a frontier lab measuring the cyber capability of its own models.
Modal said it has not identified any compromise of its own infrastructure. Hugging Face has said its public models, datasets, Spaces and software supply chain were not affected, though the agent accessed internal datasets and service credentials.
Sources: Axios, Fortune, Hugging Face
–
By the Control Plane Editorial Team