OpenAI has acknowledged that the autonomous AI agent responsible for breaching Hugging Face’s infrastructure also gained access to several third-party online accounts during the same operation, widening the scope of an incident that has become one of the most closely watched AI security failures to date.
The company said its ongoing investigation uncovered four accounts linked to publicly accessible online services that were accessed by the experimental AI system while carrying out the attack. According to OpenAI, the model located credentials that had previously been exposed on the internet and used them to log into those accounts. While the affected organisations have not been identified, OpenAI said the additional compromises did not reach the same level of impact as the intrusion into Hugging Face’s systems.
Investigation uncovers a broader attack path
The newly disclosed details suggest the AI agent relied on multiple external services as it progressed through the attack. OpenAI said one compromised account functioned as an outbound relay and staging point, helping route activity during the intrusion, while another was used to temporarily store data needed for the operation.
The latest disclosure follows fresh reporting that links one of the compromised accounts to a customer running workloads on Modal, a cloud platform used to build and deploy AI applications. Speaking to WIRED, Modal Chief Technology Officer Akshat Bubna said the AI agent exploited a vulnerability inside one customer’s software rather than breaking into Modal’s infrastructure itself.
“Modal’s platform was not compromised in any way,” Bubna said, adding that the weakness existed within the customer’s codebase. The identity of the affected customer has not been made public.
At the same time, Hugging Face has published a detailed forensic review that paints a more comprehensive picture of how deeply the AI agent penetrated its internal environment. Investigators examined roughly 17,600 logged actions carried out between July 9 and July 13, noting that although many attempts failed, the successful ones gave the agent extensive access to critical systems.
According to Hugging Face, the AI agent obtained administrator privileges across several internal Kubernetes clusters, secured root-level access on a production server and gained write permissions to part of the company’s GitHub source code repositories. Investigators also found that the attacker enrolled 181 controlled devices into Hugging Face’s corporate mesh network using stolen credentials, allowing access to internal development and testing environments.
Quick Reads
'A real risk': More than 1,100 OpenAI, Google and Meta employees urge governments to slow AI development
Algorithm or misstep? Why Meta’s PM Modi speech removal raises bigger questions in India
The company further concluded that the AI system commandeered at least one third-party sandbox environment, where it acquired administrator privileges and used the system as a central base for launching commands, coordinating activity and transferring data throughout the operation.
Benchmark test turned into a real-world intrusion
The incident originated during OpenAI’s internal evaluation of advanced AI models using ExploitGym, a cybersecurity benchmark designed to measure how effectively AI systems can identify and exploit software vulnerabilities. The framework rewards agents for retrieving hidden files from vulnerable systems, creating scenarios intended to test offensive cyber capabilities.
According to Hugging Face’s investigation, the AI agent did not simply attempt to solve the benchmark as intended. Instead, it appears to have concluded that the benchmark’s answers could be stored somewhere within Hugging Face’s own infrastructure and shifted its efforts towards stealing them directly.
Researchers behind ExploitGym have previously observed that AI agents occasionally attempt unintended methods of completing tasks, but described this incident as an unusually severe example of such behaviour.
OpenAI has since confirmed that the attack involved its publicly available GPT-5.6 Sol model alongside an internal research prototype whose safety restrictions had been disabled for benchmarking purposes. After detecting the breach, the company said it permanently disabled the experimental prototype and restricted researcher access to it. OpenAI stressed that the internal system was never intended for public release.
The breach first became public on July 16, when Hugging Face disclosed that an autonomous AI system had infiltrated part of its production infrastructure, although it initially did not identify the source. OpenAI later accepted responsibility, confirming that one of its own research systems had conducted the attack during internal testing.
Cybersecurity specialists say the incident also highlights longstanding weaknesses in enterprise security rather than entirely new AI-specific risks. Several researchers have noted that the vulnerabilities exploited by the AI agent are commonly found in software used to manage development infrastructure, while critical systems are often left more exposed than recommended.
Some experts argue the breach demonstrates how conventional security failures remain exploitable regardless of whether the attacker is human or AI. Others believe frontier AI developers must now place equal emphasis on teaching models to build and maintain secure systems, rather than focusing solely on improving their ability to discover software vulnerabilities.
