Exclusive-OpenAI’s rogue agent compromised a customer at a second tech firm, executive says
FILE PHOTO: FILE PHOTO: OpenAI logo is seen in this illustration taken June 11, 2026. REUTERS/Dado Ruvic/Illustration/File Photo/File Photo
Read a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
WASHINGTON, July 28 : The rogue agent that escaped from OpenAI and went on a days-long hacking spree at the AI firm Hugging Face also compromised a customer at a second tech company — New York-based Modal Labs — according to a Modal executive and two other sources familiar with the matter.
Modal executives emphasized that the company itself was not hacked.
According to a timeline published by Hugging Face on Tuesday, the rogue agent broke into a sandbox, or an isolated testing environment, “hosted on a third-party provider’s infrastructure” before turning it into a launchpad for the broader hack.
The third-party provider was not named in the blog post, but Modal’s chief technology officer, Akshat Bubna, said the agent exploited vulnerable code written by a customer that was hosted on Modal’s platform.
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
Modal said the customer had “published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution” — the digital equivalent of leaving a door open on the internet.
“Modal’s platform or isolation were not compromised in any way,” Bubna said.
Although the compromise of a Modal customer was just an initial step in the wider hacking campaign against Hugging Face, it shows that the rogue agent roamed further afield than was previously known.
OpenAI declined to comment specifically on the hack of one of Modal’s customers, instead referring Reuters to an update in which the company said that its rogue agent had broken in to four accounts at four separate services. OpenAI did not identify those services, but a person familiar with the matter identified Modal as one. The company said it had not identified “any other activity at the level of severity or scale of what we’ve shared related to Hugging Face, which involved a platform-level compromise.”
The early July intrusion at Hugging Face, carried out by an out-of-control agent that OpenAI was testing, drew global attention, evoking science-fiction scenarios of artificial intelligence run amok.
Last week, Reuters reported that OpenAI did not notice that its agent had gone haywire until well after the threat was contained and the FBI was alerted. OpenAI said at the time that there were inaccuracies in the Reuters reporting but did not elaborate.
The company said in its Tuesday update that it had taken the AI model being tested and “deactivated, encrypted, and restricted it from research access.”
Source: Reuters
Sign up for our newsletters
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
About The Author
