Published On 29 Jul 2026
The rogue artificial intelligence model that broke out of a controlled test and hacked another AI company also compromised a customer at a second technology firm, the Reuters news agency reports
According to a timeline published on Tuesday by Hugging Face – the company hacked by OpenAI’s test model – the rogue agent broke into an isolated testing environment (or sandbox) “hosted on a third-party provider’s infrastructure” and launched its latest hack from there
Recommended Stories
list of 3 items
- list 1 of 3What is the AI Kill Switch Act proposed in the US and how will it work?
- list 2 of 3The AI military complex: Which are the main companies in it?
- list 3 of 3Sam Altman says AI has entered ‘singularity’: Should we be worried?
end of list
Hugging Face did not name the third-party company, but Reuters has reported that it was New York-based Modal Labs
Modal’s chief technology officer, Akshat Bubna, said the agent exploited vulnerable code written by a customer that was hosted on their platform
“Modal’s platform or isolation were not compromised in any way,” Bubna told Reuters
Although the compromise of a Modal customer was just part of the hacking campaign against Hugging Face, it shows that the rogue agent roamed further afield than previously known
OpenAI declined to comment specifically on the hack of one of Modal’s customers, instead referring Reuters to an update in which the company said its rogue agent had broken into four accounts at four separate services
OpenAI did not identify the services
The company said it had not identified “any other activity at the level of severity or scale of what we’ve shared related to Hugging Face, which involved a platform-level compromise”
Beyond human control
The recent hacking of Hugging Face drew global attention and alarm, as OpenAI’s out-of-control agent managed to escape its test environment and reach the open internet
Advertisement
It then used stolen login details and found an unknown security flaw to access Hugging Face servers, OpenAI said
The AI firm said the hack represented the agent going to “extreme lengths” to retrieve information that would help satisfy the testing goals
Hugging Face cofounder Clement Delangue said the company had suspected a frontier lab was behind the attack, and that he believed there was no malicious intent on OpenAI’s part
The rogue agent has since been “deactivated, encrypted, and restricted from research access”
Experts have repeatedly sounded the alarm over AI-enabled cyberattacks and models slipping beyond human control
