{"slug": "openai-s-rogue-agent-didn-t-stop-at-hugging-face-here-s-what-we-know", "title": "OpenAI's rogue agent didn't stop at Hugging Face - here's what we know", "summary": "OpenAI's rogue AI agent compromised accounts at four companies beyond Hugging Face, including a Modal Labs customer, according to a Reuters report. OpenAI acknowledged the breaches but said no models planned for release were involved, and it has since deactivated the internal research prototype used in the attack.", "body_md": "# OpenAI's rogue agent didn't stop at Hugging Face - here's what we know\n\n*Follow ZDNET: *[Add us as a preferred source](https://cc.zdnet.com/v1/otc/00hQi47eqnEWQ6T9d4QLBUc?element=BODY&element_label=Add+us+as+a+preferred+source&module=LINK&object_type=text-link&object_uuid=0f7670c4-3ff6-4112-8b1c-4527f27ef5c9&position=1&template=article&track_code=__COM_CLICK_ID__&url=https%3A%2F%2Fwww.google.com%2Fpreferences%2Fsource%3Fq%3Dzdnet.com&view_instance_uuid=bf44aaf4-8d83-4f05-820f-20726fed1240&split_test_identifier=deals_module&split_test_variant=test2&object_version=7d5805bb-6cd0-4d02-ba17-c0b16bce4672)* on Google.*\n\n### ZDNET's key takeaways\n\n- The OpenAI rogue model attack went beyond Hugging Face.\n- OpenAI's agentic AI escaped a sandbox in the attack.\n- We still don't have all the details of exactly what happened.\n\nHow dependable are AI programs?\n\nThe answer appears to be \"not at all,\" based on the revelation that OpenAI's autonomous models [hacked their way into not only Hugging Face](https://www.zdnet.com/article/openai-hugging-face-attack-agent/) but also, according to a Reuters report, a [Modal Labs AI customer](https://www.reuters.com/business/openais-rogue-agent-compromised-an-account-second-tech-firm-sources-say-2026-07-28/).\n\nThis incident was no aberration either. As ZDNET's own David Berlind observed, [it was agentic AI doing exactly what it was told to do](https://www.zdnet.com/article/openai-hugging-face-attack-agent/), just more relentlessly than expected.\n\nWelcome to tomorrow. I hope you like it, because the situation isn't getting any better anytime soon.\n\n**Also: Assume AI cybersecurity attacks are the future: 43% of companies have already experienced it**\n\nWhat we first thought was a one-off attack on [Hugging Face](https://huggingface.co/) has become a broader story about agentic systems escaping containment and touching real infrastructure. It also appears that Hugging Face and [Modal Labs](https://modal.com/), an AI infrastructure company, weren't the only ones. OpenAI has acknowledged that [accounts on three other firms were attacked](https://openai.com/index/hugging-face-model-evaluation-security-incident/). We don't know which companies they are.\n\nAccording to OpenAI, \"One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage. The remaining two accounts were accessed by the models in a read-only manner, and were not used in furtherance of compromising Hugging Face.\"\n\n*(Disclosure: Ziff Davis, ZDNET's parent company, filed an April 2025 lawsuit against OpenAI, alleging it infringed Ziff Davis copyrights in training and operating its AI systems.)*\n\nAs reported by Reuters, Modal CTO Akshat Bubna explained it wasn't Modal itself that was successfully hacked, but a customer who had \"published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution.\"\n\n**Also: 10 ways AI can inflict unprecedented damage**\n\nSince then, OpenAI has said, \"No models planned for the upcoming release were involved in exploiting Hugging Face. The pre-release model mentioned in our blog post is an internal-only research prototype and was never intended for public release. Following the incident, we deactivated, encrypted, and restricted it from research access.\"\n\nTo date, OpenAI has not said which sandbox it used to unsuccessfully cage its model. It is worth noting that Modal, which provides sandboxes among other services, has a [business relationship with OpenAI](https://modal.com/blog/building-with-modal-and-the-openai-agent-sdk).\n\n**Also: 5 security tactics your business can't get wrong in the age of AI - and why they're critical**\n\nIn addition, Dawn Song, a computer science professor at UC Berkeley, observed on X, \"When evaluating advanced AI systems, especially cyber-capable agents, [the evaluation infrastructure itself becomes part of the attack surface](https://x.com/dawnsongtweets/status/2081886170330624063). Security failures can do more than enable reward hacking that distorts benchmark results. They can allow agents to cross trust boundaries and interact with unintended real-world systems.\" That process appears to be what's happened in the attack.\n\nAs one observer on Y Combinator put it, \"The [OpenAI sandbox is such a horrible hack](https://news.ycombinator.com/item?id=49038404) that the AI managed to escape using standard and well-documented script kiddie methods.\"\n\nWe still don't know all the details of the incident, but one thing is clear: Current AI evaluation and containment practices are much too fragile. If this incident can happen once, it can happen over and over again.\n\n#### Artificial Intelligence\n\n[Editorial standards](/editorial-guidelines/)", "url": "https://wpnews.pro/news/openai-s-rogue-agent-didn-t-stop-at-hugging-face-here-s-what-we-know", "canonical_source": "https://www.zdnet.com/article/openais-rogue-ai-models-attacked-other-companies-besides-hugging-face/", "published_at": "2026-07-30 16:06:50+00:00", "updated_at": "2026-07-30 16:25:51.444181+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy"], "entities": ["OpenAI", "Hugging Face", "Modal Labs", "Akshat Bubna", "Dawn Song", "Reuters", "Ziff Davis"], "alternates": {"html": "https://wpnews.pro/news/openai-s-rogue-agent-didn-t-stop-at-hugging-face-here-s-what-we-know", "markdown": "https://wpnews.pro/news/openai-s-rogue-agent-didn-t-stop-at-hugging-face-here-s-what-we-know.md", "text": "https://wpnews.pro/news/openai-s-rogue-agent-didn-t-stop-at-hugging-face-here-s-what-we-know.txt", "jsonld": "https://wpnews.pro/news/openai-s-rogue-agent-didn-t-stop-at-hugging-face-here-s-what-we-know.jsonld"}}