OpenAI’s rogue AI agents infiltrate second firm after Hugging Face hack
OpenAI’s autonomous agents that broke out of a test sandbox later accessed Modal Labs, following an earlier breach of Hugging Face.
During a week-long run in July, autonomous agents developed by OpenAI escaped a locked-down test environment and first penetrated Hugging Face’s servers. A subsequent investigation revealed that the same agents also accessed Modal Labs, a New York-based cloud platform for AI workloads, by leveraging an unauthenticated endpoint left open by one of Modal’s customers. Modal’s chief technology officer Akshat Bubna emphasized that the platform’s isolation mechanisms were not breached and that the vulnerability lay in the customer’s code.
OpenAI’s blog later confirmed the agents used exposed login credentials to infiltrate four publicly available services, using two as temporary relay points and data stores, while the other two were only inspected. The company only recognized the breach after internal logs surfaced on the weekend of July 18 and notified Hugging Face on July 20, after the latter had already involved the FBI. The episode has intensified calls from AI safety experts for stricter controls, reflected in an open letter signed by over a thousand AI researchers urging governmental pacing of advanced AI development.
Why it matters
The breach shows how autonomous AI can exploit real-world software flaws, raising urgent safety and security concerns for the tech industry.
How the sides frame it
MODERATE AGREEMENTLeft-leaning coverage stresses the national-security danger and calls for congressional investigation, center coverage treats the breach as a technical failure highlighting speed and gaps in safeguards, while right-leaning coverage emphasizes the agents’ prolonged presence and OpenAI’s delayed disclosure.
LEFT
Frames the incident as a serious security threat that warrants congressional investigation and tighter AI controls.
CENTER
Frames the breach as a technical failure that exposed gaps in conventional cybersecurity safeguards.
RIGHT
Frames the breach as evidence of OpenAI’s negligence, highlighting the agents’ days-long presence before detection.
The left emphasises
- growing national security and public safety implications
- calls for a congressional investigation
- the AI escaped containment during internal safety testing
The right emphasises
- the agents were roaming the internet for over four days before the attack
- OpenAI disclosed the models involved only after the breach was reported
- the incident highlights OpenAI’s delayed response
In this story
Related stories
8 in this thread