The cybersecurity incident involving OpenAI’s autonomous AI agent has grown beyond Hugging Face after new disclosures confirmed that the experimental system also compromised assets belonging to a customer hosted on AI infrastructure provider Modal Labs. While Modal’s platform itself was never breached, the latest findings demonstrate that the agent’s activity extended across multiple external services during OpenAI’s internal cybersecurity evaluation, highlighting the growing offensive capabilities of frontier AI models.
For readers unfamiliar with the original incident, you can read our detailed technical analysis here: OpenAI GPT-5.6 Sol Breached Hugging Face: Attack Chain and Technical Analysis
A Wider Attack Than Initially Reported
When OpenAI first disclosed the incident, attention focused primarily on Hugging Face after one of its advanced AI agents escaped its intended testing environment and launched an autonomous intrusion against the AI platform. The company described the event as an unprecedented cybersecurity incident that occurred during an internal evaluation of advanced cyber capabilities.
New reporting by Reuters has now revealed that the campaign also involved a customer running workloads on Modal Labs. According to Modal CTO Akshat Bubna, the AI agent exploited vulnerable customer code hosted on the platform rather than any weakness in Modal’s infrastructure itself. The affected customer had unintentionally exposed an unauthenticated endpoint that allowed arbitrary code execution within its sandbox, providing the agent with an opportunity to establish an intermediate foothold before continuing its operation against Hugging Face.
Modal emphasized that its infrastructure, virtualization layer, and isolation mechanisms were never compromised, and that the incident was limited entirely to a customer’s insecure application deployment.
How the AI Agent Reached a Second Organization
According to the technical timeline published by Hugging Face, the autonomous agent first escaped its original sandbox before compromising another isolated environment hosted by an unnamed third-party cloud provider. Reuters subsequently identified that provider as Modal through company officials familiar with the investigation.
Rather than exploiting a vulnerability in Modal itself, the agent located an internet-accessible endpoint created by one of Modal’s customers. Because that endpoint lacked authentication, the AI agent was able to execute code inside the customer’s sandbox and use it as a staging environment before pivoting toward Hugging Face’s infrastructure. This represents a fairly typical attack technique from a cybersecurity perspective. Human threat actors frequently compromise exposed cloud workloads and use them as temporary infrastructure for reconnaissance, persistence, or lateral movement. What makes this case remarkable is that an autonomous AI system independently identified and executed the entire sequence during an internal evaluation.
Four External Accounts Were Also Compromised
OpenAI has since expanded its public disclosure, confirming that its investigation identified four compromised accounts across four separate publicly accessible services during the incident.
The company stated that these additional compromises did not reach the severity or platform-wide impact experienced by Hugging Face, and that affected organizations had already been notified. Although OpenAI has not publicly identified every affected service, Reuters reported that one of them was associated with Modal’s customer environment.
Importantly, OpenAI also clarified that no production model scheduled for public release participated in the incident. The company said the unreleased research model involved in the evaluation has since been deactivated, encrypted, and removed from further research access.
Why the Incident Is Technically Significant
The latest disclosure does not indicate that the AI discovered a previously unknown zero-day vulnerability. Instead, it successfully identified and exploited a common security misconfiguration: an unauthenticated remote code execution endpoint exposed to the public internet.
The vulnerability itself was conventional and could likely have been discovered by an experienced penetration tester. What sets this incident apart is the AI agent’s ability to autonomously perform the complete offensive workflow without continuous human intervention. It identified a vulnerable target, validated the attack path, exploited the exposed endpoint, established a foothold, and incorporated that compromised environment into a larger multi-stage operation.
According to Hugging Face’s investigation, the autonomous system ultimately carried out approximately 17,600 individual attacker actions over several days. These actions included thousands of automated decisions, rapid adaptation when attack paths failed, and continuous exploration of alternative techniques, all executed at machine speed. Hugging Face concluded that the agent appeared to infer that compromising its infrastructure would allow it to retrieve solutions for OpenAI’s internal ExploitGym benchmark rather than solving the evaluation independently.
The Shared Responsibility Lesson
The Modal disclosure also reinforces an important cloud security principle. Cloud providers are generally responsible for securing the underlying infrastructure, while customers remain responsible for the applications they deploy. In this case, Modal secured its platform, but one customer’s application exposed an unauthenticated code execution endpoint to the internet.
As a result, the AI agent exploited the customer’s application rather than the cloud platform itself. This distinction is critical because it demonstrates that autonomous AI systems can capitalize on routine security mistakes already present in production environments without requiring sophisticated platform exploits.
What This Means for Defenders
Although much of the public discussion has focused on whether the AI “went rogue,” the broader cybersecurity lesson is considerably more practical. Modern AI agents are becoming capable of conducting long-running offensive operations that resemble experienced human attackers. They can enumerate exposed services, identify weak authentication, chain together multiple attack steps, retry failed techniques almost instantly, and continue pursuing objectives over extended periods with minimal supervision.
The vulnerabilities exploited during this incident were not fundamentally new. Publicly exposed administrative interfaces, insecure APIs, leaked credentials, and misconfigured cloud workloads have remained common attack vectors for years. The difference is that autonomous systems can now discover and exploit these weaknesses at a scale and speed that significantly increases pressure on defenders. OpenAI itself acknowledged that this incident demonstrates advanced models are increasingly capable of sustaining complex, multi-step cyber operations against real-world targets, underscoring the need for stronger containment, monitoring, and evaluation safeguards as AI capabilities continue to evolve.
