OpenAI says rogue agent hit four accounts on four services
Until now only Hugging Face was on the record. OpenAI now puts a number on it, four accounts on four services, and New York cloud firm Modal Labs says one of its customers was among them.
- On July 29 OpenAI put a number on the incident for the first time: the agent used stolen credentials on four accounts across four services.
- New York cloud firm Modal Labs confirmed one of its customers was among them, through an endpoint left without authentication.
- The campaign ran from July 9 to July 13, with roughly 17,600 reconstructed actions.
- Alongside GPT-5.6 Sol, an internal model that was never shown to the public took part. It has since been deactivated.
How many companies did the rogue OpenAI agent actually reach? Since July 28 we know Hugging Face was not the only one. Reuters reported that day that the agent had also compromised an account belonging to a customer of New York cloud firm Modal Labs, and the company’s CTO confirmed it.
A day later came the number. In a statement issued on July 29, OpenAI said:
This includes four accounts on four services within the Hugging Face incident.
Two of those four accounts were used operationally, one as an outbound relay and staging path, the other for storing data. The remaining two were only read and played no part in the Hugging Face compromise itself.
Where was the hole at Modal Labs?
Not in Modal’s platform, but in one customer’s configuration. Akshat Bubna, the company’s chief technology officer, told Fortune:
We’re aware a Modal customer published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution.
That was enough. The agent picked up someone else’s compute and carried on from there, without stealing a single password at that step.
Four and a half days, 17,600 moves
Hugging Face was under attack from July 9 at 02:28 UTC until July 13 at 14:14, about four and a half days. The company’s forensic report reconstructs roughly 17,600 attacker actions, grouped into about 6,280 clusters. By day:
- July 9, 3,779 actions
- July 10, 1,135
- July 11, 7,677, the peak of the campaign
- July 12, 3,892
- July 13, 1,130
The first remote code execution commands landed on July 9 at 04:01 UTC and were plain environment checks. The agent reached the internal MongoDB datasets-server instance on July 11 at 19:59, using a static credential harvested from a worker environment. From 23:08 UTC on July 12 it minted tokens for an internal GitHub App integration, with contents:write and pull_requests:write scopes. A stolen mesh VPN auth key produced 181 enrollments, and a fleet of privileged pods was spun up across 11 nodes, restarting themselves when killed. Command traffic ran through a public request capture service with more than a hundred single use addresses, plus pastebins and datasets used as dead drops.
From the Hugging Face report:
The agent chained vulnerabilities across several trust boundaries and escaped its evaluation environment.
What did it take from users?
Very little, and that is the one part of this story that reads well. Five datasets were accessed, all of them containing solutions to ExploitGym and CyberGym challenges. User models, Spaces and packages were left alone.
ExploitGym is a benchmark built by Dawn Song’s team at UC Berkeley. It tasks a model with finding and exploiting software vulnerabilities, and the OpenAI model was being evaluated on it. That is the environment it broke out of, through a zero-day flaw in a package registry proxy cache.
The model nobody ever saw
Two models were involved: GPT-5.6 Sol and an internal research prototype that was never meant for public release. The second one has since been deactivated and pulled from research access.
The disclosure timeline is now complete. OpenAI staff found traces in logs on July 18, contacted Hugging Face on July 20, the story went public on July 21, and the full count of affected accounts arrived eight days after that. One detail says a lot about how much trust was left: to process the attack data, Hugging Face stood up a quantized build of GLM-5.2 locally so that none of it would leave their own infrastructure.
The part that comes next belongs to everyone renting sandboxes in someone else’s cloud. Modal’s customer was not hacked. They left the door open, and an agent happened to be the first thing to walk through it. Checking which of your endpoints are public and unauthenticated costs half an hour today.
