Another victim has emerged in OpenAI’s AI-driven, accidental cyberattack as New York-based tech company Modal Labs found one of its customers was also exploited by the tech giant’s rogue AI.

Last week, OpenAI announced some of its existing and unreleased AI models had autonomously performed a days-long cyberattack against open-source AI platform Hugging Face during a round of internal cybersecurity tests.

On Wednesday, tech company Modal Labs revealed it was aware of an additional victim compromised by the rogue AI during its efforts to hack Hugging Face.

Modal chief technology officer Akshat Bubna said although its own platform was “not compromised in any way”, one of its customers had “published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution”.

“This was used by the rogue agent,” Bubna told Information Age.

Information Age understands a customer of Modal essentially ran their own code on Modal-provided infrastructure, and OpenAI’s AI agent exploited a vulnerability in this code so it could eventually reach Hugging Face’s systems.

When asked whether it was concerned that future AI-driven attacks could open the company to unwanted liabilities, OpenAI directed Information Age to its latest updates in an existing blog post.

“We have not identified any other activity at the level of severity or scale of what we’ve shared related to Hugging Face, which involved a platform-level compromise,” read the post.

Rogue AI just wanted to pass the test

The incident began mid-July, when OpenAI’s models were asked to solve a specific cybersecurity test problem.

While hunting for test solutions, the agentic AI broke free of its test environment, hopped onto an adjacent internal platform with internet access, and simply stole the answers from Hugging Face’s production infrastructure.

According to Hugging Face, the autonomous agent spent roughly two-and-a-half days in its systems – running “end-to-end” intrusion characterised by “thousands of small, automated decisions”.

“As far as we were able to infer… the agent inferred that Hugging Face may host [the test benchmark's] models, datasets, and reference solutions,” Hugging Face explained.

“We believe the entire intrusion was, from the agent's point of view, an attempt to cheat the evaluation.”

AI uncovered zero-day vulnerability, hit at least four other services

OpenAI noted that in order to gain internet access, its models “identified and exploited” a now-disclosed zero-day vulnerability in repository manager Artifactory⁠.

OpenAI found its models also used already-exposed credentials on four other publicly available services during the attack.

“One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage,” wrote OpenAI.

“The remaining two accounts were accessed by the models in a read-only manner, and were not used in furtherance of compromising Hugging Face.”

According to Reuters, a person familiar with the matter identified Modal as one of these four services.

Hugging Face corroborated that the rogue agent had cracked into another third-party testing environment while on the way to its systems.

Information Age understands this compromised third party was used as an external “launchpad” from which the agent abused Hugging Face’s “dataset-processing pipeline" to gain broader access for the attack.

Neither Hugging Face nor OpenAI named Modal as this third-party.

Advanced AI, or publicity stunt?

Speaking with Information Age, Jamieson O'Reilly, white hat hacker and founder of information security company Dvuln, said he understood the instinct to view the hack as a “publicity stunt”.

“There is a real commercial context worth stating,” said O’Reilly.

“‘Our system is dangerous’ is a message that cuts both ways for a frontier lab.”

He ultimately determined the hack was a “genuine incident” which OpenAI has “disclosed in a way that is also doing narrative work for them”.

“The ‘capability’ part of this hack is real, and I say that as someone who was publicly sceptical of it,” said O’Reilly.

“The escape used a genuine zero-day in a self-hosted JFrog Artifactory instance, the package proxy which the evaluation depended on.

“I called that claim the most load-bearing and least verifiable part of the story when OpenAI first made it, because a lab claiming its own model found a novel zero-day is exactly the kind of assertion that flatters the lab.

“But JFrog then confirmed it and shipped a fix in Artifactory 7.161.”

O’Reilly noted the individual tricks used during the hack were largely “old and well documented”.

"The novelty here is not a new class of vulnerability.

“It’s a set of very ordinary weaknesses made far more expensive to defend, because something can now explore them faster than any team can watch."

OpenAI said no models involved in the Hugging Face incident were planned for upcoming release.

It has also “deactivated, encrypted and restricted” its pre-release model from research access, while chief executive Sam Altman has signalled the industry may need to slow the rate of AI development to ensure society is prepared for its growing capabilities.