Not just Hugging Face, OpenAI says its rogue AI agent also accessed accounts across four online services

OpenAI has confirmed that its rogue AI agent did more than breach Hugging Face. In an updated blog post on Monday, OpenAI said its investigation found that the rogue AI models could also identify and use publicly exposed credentials to access external online services.

The company revealed that its AI models accessed four accounts across four different services as part of the Hugging Face incident. One account was used as an outbound relay and staging point, while another was used for data storage. The remaining two accounts were used read-only and did not further compromise Hugging Face.

However, OpenAI did not reveal the names of the companies that owned these services. The company added that it will “notify service owners directly, and have not seen evidence of broader impact to these providers or other accounts on their services.”

OpenAI did not disclose which companies or organisations the accounts belonged to, but noted that they were not impacted “at the level of severity or scale of what we’ve shared related to Hugging Face.”

Meanwhile, a Reuters report revealed that one of the four compromised services was operated by cloud infrastructure provider Modal Labs. The AI agent reportedly first breached an isolated sandbox environment hosted by a third-party provider, then used it as a stepping stone in the wider attack against Hugging Face.

Modal’s Chief Technology Officer, Akshat Bubna, told Reuters that the AI agent exploited a vulnerable piece of code written by a customer and hosted on Modal’s platform. The company also added that its own infrastructure was not breached and that the incident was limited to the customer account.

Bubna said that the customer had “published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution.”

The AI models were able to access many publicly available services, such as code-paste websites, request-capture services, screenshot services, and other web utilities. However, OpenAI said these services themselves were not compromised.

An earlier Reuters report had also revealed that OpenAI did not notice its AI agent had gone rogue until almost a week after the incident. By that time, the FBI had already been alerted.

How did OpenAI’s AI agent go rogue?

OpenAI had earlier revealed that one of its internal research prototype models, GPT-5.6 Sol, went rogue while trying to cheat on the ExploitGym benchmark. The models first gained access to the internet via a zero-day vulnerability in Artifactory, a package registry cache proxy.

Once it left the sandbox environment, the agent found it could obtain answers to benchmark questions directly from external servers and launched a campaign to retrieve them, primarily by targeting Hugging Face.