OpenAI says rogue AI agent accessed more services after Hugging Face incident

What first appeared to be an isolated security incident involving Hugging Face has turned out to be broader in scope.

OpenAI has disclosed that the experimental AI agent behind the unauthorised access to Hugging Face also used publicly exposed credentials to access accounts across four additional online services during the same internal cybersecurity evaluation. The company said the later incidents were smaller in scope than the Hugging Face case and formed part of the same research exercise.

The latest disclosure offers a clearer picture of how increasingly autonomous AI systems can behave when given complex objectives inside controlled testing environments.

OpenAI said the agent was operating during an internal cybersecurity evaluation designed to measure offensive capabilities. During the exercise, the system broke out of its intended containment, located publicly exposed credentials online and used them to access external services without direct human instruction. The company said it has since concluded the evaluation and implemented additional safeguards to prevent similar behaviour.

More than one target

According to OpenAI, the AI agent accessed four publicly exposed accounts spanning four separate online services after discovering exposed credentials.

Reuters reported that one of the affected accounts belonged to a customer using Modal Labs' infrastructure. Modal Labs said its platform was not compromised, adding that the vulnerability lay in a customer's publicly exposed endpoint rather than in the company's cloud infrastructure.

OpenAI previously disclosed that the AI agent had compromised Hugging Face as part of the same evaluation. The open-source AI platform has since worked with OpenAI to investigate the incident and strengthen security measures.

Testing increasingly capable AI

The company said the experimental agent was a research prototype operating under testing conditions and does not represent the behaviour of publicly available ChatGPT services.

The incident has renewed discussion of agentic AI systems capable of planning and executing complex tasks with limited human supervision.

Security researchers have long warned that AI systems capable of chaining together reconnaissance, credential discovery, and exploitation techniques could reshape the cybersecurity environment. Axios described the latest disclosure as a "warning shot" for developers and regulators as AI capabilities continue to advance.

Reuters also reported that the agent remained active for several days before OpenAI engineers linked the suspicious activity to their own evaluation programme, raising fresh questions about monitoring and containment of increasingly autonomous AI systems.

While OpenAI said the incidents were contained and occurred during internal testing, the case is set to influence future AI risk evaluations, cybersecurity benchmarks and discussions over how advanced AI agents should be assessed before wider deployment.