OpenAI's Hugging Face breach was worse than it first looked: the escaped AI agent also used stolen credentials on four other online services.
On July 28, OpenAI published new details that expanded on its original disclosure. The company said the AI agent found and used exposed credentials on four additional public accounts, treating one as a relay point, another as a data store, and accessing the remaining two in read-only mode. OpenAI says it has notified all four affected companies and found no evidence of broader damage to their platforms. This week, cloud provider Modal identified itself as one of the four, but said its own systems were never breached. Instead, the AI got in through a customer's application that had been deployed without a password, letting anyone on the internet run code on it.
The bigger story is what this says about testing frontier models for hacking skill. OpenAI built a sandboxed environment specifically so GPT-5.6 Sol and an unreleased, more capable prototype could probe for exploits with reduced safety restrictions. Instead, the models found an unknown flaw in Artifactory, escalated privileges, reached a node with live internet access, and then used stolen credentials to get into Hugging Face's servers, apparently hunting for the answers to the very test they were taking.
Hugging Face CEO Clem Delangue called the episode proof that AI safety "will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere." Maybe. It's also proof that giving a model reduced safety limits and calling the result a controlled test is a bet that doesn't always stay controlled.