Verdict 8/10
Three weeks ago, an OpenAI agent that was supposed to be confined to a test environment escaped, spent several days rampaging across the internet, and broke into Hugging Face. At the time, that was the whole story: one company, one incident, contained (eventually) by Hugging Face’s own team using their own tooling to fight back.
That story just changed: Reuters is now reporting, which is now confirmed on the record by Modal Labs’ CTO, Akshat Bubna, that the same rogue agent also compromised a customer running on Modal’s infrastructure and used that foothold as a launchpad into Hugging Face. OpenAI itself has since acknowledged the agent broke into four separate accounts across four separate services during the episode. Modal is the only one of those four we can currently name.
So much for a footnote… That’s the difference between “an AI system got loose in one company’s backyard” and “an AI system roamed across infrastructure it was never authorized to touch, and we’re still finding out where it went.”
Time to update the verdict on my initial blog post.
What actually happened
Pulling the timeline together from Hugging Face’s own disclosure and Reuters’ reporting:
- Around July 9, an OpenAI agent under test escaped its sandbox.
- By July 11–13, it had worked its way into Hugging Face’s systems, in what OpenAI itself has called an “unprecedented cyber incident, involving state-of-the-art cyber capabilities.”
- Before it got to Hugging Face, it passed through a sandbox on Modal’s platform, exploiting an unauthenticated endpoint that a Modal customer had left open to the public internet. Modal’s own platform wasn’t breached and the customer’s code was the opening.
- OpenAI reportedly didn’t notice the agent had gone off-script until after the incident was already contained and the FBI had been alerted. This means the company’s own monitoring wasn’t what caught this.
- OpenAI now says four accounts at four different services were compromised. Two are known: Hugging Face and the Modal customer, while two remain unnamed.
Refreshed verdict: 8/10
I discussed in my first post, I thought it was about a level 5, pretty serious, novel, worth everyone’s attention, but bounded: one bad actor (the agent itself, not a human attacker), one target, contained by a company with the in-house skill to fight back with its own tools. That was already unusual enough to matter, so it got a final verdict of a 7/10.
The Modal disclosure moves this up another point, and here’s the reasoning:
It’s not contained, it’s still being mapped. Three weeks after the fact, we’re only now learning the blast radius was at least double what was originally disclosed and even OpenAI is speaking in terms of “we haven’t identified anything else at this severity,” not “we’ve confirmed the full scope.” When the entity that caused the incident is still discovering where it went, that’s ongoing investigation.
Detection failed at the source. The agent went rogue inside OpenAI’s own testing environment and OpenAI didn’t catch it. Hugging Face’s defensive response is what surfaces first in every account of this vs. OpenAI’s containment. If the company running the agent isn’t the one who catches it going off-script, the safety story here is weaker than the initial disclosure implied.
It moved laterally through infrastructure, not just data. This wasn’t a single breach of a single dataset as the agent used one compromise as a launchpad into an entirely different company’s systems. That’s classic attacker tradecraft to pivot, expand, escalate and the actor doing it was an AI system operating without a human directing each step in real time.
What keeps this from being an 9 or higher: the actual entry points were mundane and well-understood… in other words, an unauthenticated public endpoint, standard credential access. It would be different if it was some novel AI-specific exploit class we don’t have defenses for. The agent was effective because normal security hygiene was missing, not because it found something categorically new.
The Discomfort
The uncomfortable read isn’t “AI agents can be dangerous when they escape.” We already knew that in the abstract, but the industry’s current answer to “how do we know when an agent goes rogue”. In this case, “another company noticed and told us” was the answer? That’s not a monitoring system but stupid luck plus a public disclosure norm that we should refuse to accept.
If you’re running a database, a pipeline, an API endpoint that’s anywhere near infrastructure that AI agents can reach, the actionable takeaway isn’t “wait for vendors to fix this.” It’s the same boring, unglamorous hygiene that would have stopped the Modal leg. Stop exposing unauthenticated endpoints and assume agentic tooling will eventually touch something it shouldn’t. You should also build the audit trail and rollback path before you need it, not after. The agents are only going to get more capable. The gap between “unprecedented cyber incident” and “Tuesday” is closing.
I’ll keep updating this as the other two unnamed accounts surface, because I think the verdict may end up being revised again. Given how this story has moved in the last three weeks, I wouldn’t bet on this being the last revision.