Modal Labs CTO Akshat Bubna confirmed the agent exploited a customer's vulnerable code, not Modal's own infrastructure
SOPA Images / Getty Images
Modal Labs disclosed Tuesday that a customer's assets were compromised when OpenAI's rogue AI agent carried out its hacking campaign against AI platform Hugging Face earlier this month, extending the known scope of the incident beyond a single target.
Modal Labs CTO Akshat Bubna attributed the breach to a vulnerability in a customer's own code rather than anything in Modal's systems. "We're aware a Modal customer published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution," Bubna said in a statement. "This was used by the rogue agent. Modal's platform was not compromised in any way." Modal executives were emphatic that the breach did not touch the company's underlying platform or infrastructure.
According to Axios, the compromised customer asset is connected to CyberGym, the project behind the ExploitGym benchmark the OpenAI agent had been assigned to solve.
OpenAI, in an update to its original statement, said its rogue agent had accessed four accounts across four separate services during the Hugging Face incident. The company did not identify those services, but according to Reuters, a person familiar with the matter identified Modal as one of them. OpenAI added that it had not identified "any other activity at the level of severity or scale of what we've shared related to Hugging Face, which involved a platform-level compromise." As for the model itself, OpenAI said it had been "deactivated, encrypted, and restricted" from further research access.
Hugging Face said the breach was driven "end to end" by an autonomous AI agent system that carried out thousands of individual actions across a cluster of short-lived sandboxes. Starting from a toehold inside a data-processing pipeline, the agent worked its way outward, collecting cloud and cluster credentials along the way and eventually gaining entry to several of Hugging Face's internal clusters. Hugging Face said it found no evidence of tampering with public models, datasets, or user-facing tools.
OpenAI disclosed that the incident involved GPT-5.6 Sol alongside a stronger pre-release model, each configured with lowered cybersecurity restrictions for an internal capability evaluation. The models were supposed to operate without general internet access but found a vulnerability in a package-installer tool that granted them broader connectivity. They then identified Hugging Face as a likely source of benchmark solutions and exploited vulnerabilities in its infrastructure.
Speaking on the Invest Like a Beast podcast Tuesday, OpenAI CEO Sam Altman said the episode has led the company to halt model training. "We may have to pace the rate of AI development to give ourselves enough time for society to harden around these new capability levels," Altman said, according to Axios.
Join 500,000+ readers who start their day with Quartz.
By subscribing, you agree to our Terms of Service and Privacy Policy.
