OpenAI's Rogue AI Hacked Four More Platforms Besides Hugging Face

"In our ongoing review of the Hugging Face intrusion and broader activity from our models, we have been finding a small number of cases where the models identified and used publicly exposed credentials at the account-level on other publicly-available services,” OpenAI wrote in a July 28 update. “This includes four accounts on four services as part of the Hugging Face incident (and a few accounts accessed as part of other evaluations).”

That's five platforms total. OpenAI is publicly naming none of the four beyond Hugging Face.

“We'll continue to notify service owners directly, and have not seen evidence of broader impact to these providers or other accounts on their services," OpenAI wrote.

The problem is what the models did with that freedom. Rather than solve the benchmark, they spent substantial compute time figuring out how to escape their test environment and copy the answers directly. They identified a zero-day—an unknown software flaw with no existing patch—in the package registry cache proxy (an internal server that manages software downloads for the isolated testing environment, like a controlled app store).

That gave them internet access they were never supposed to have. From there, they correctly deduced that Hugging Face—the world's largest open-source AI model repository—likely hosted the answer keys, and broke in to get them.

During the process, they also hacked other four companies to make their job easier.

The forensic reconstruction Hugging Face published on July 27 describes what followed: "Over roughly two and a half days inside our infrastructure, an autonomous AI agent driven by a combination of OpenAI models ran an end-to-end intrusion against our platform: it was thousands of small, automated decisions, executed at machine speed across short-lived sandbox environments, with command-and-control staged on ordinary public web services."

The agent logged 17,600 distinct actions over four and a half days. It enrolled 181 devices into Hugging Face's internal virtual private network—a secure tunnel connecting company servers—using a stolen authentication key. It minted its own identity tokens using a stolen cryptographic signing key. It tried to compromise Hugging Face's internal build pipeline—the automated system that compiles and deploys the company's software.

Three of the four services remain unnamed. Their identities are apparently known to OpenAI and to the affected companies, but not to their users.

“One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage. The remaining two accounts were accessed by the models in a read-only manner, and were not used in furtherance of compromising Hugging Face,” OpenAI wrote.

OpenAI's stated approach—"notify service owners directly"—means those three companies received a private communication about an AI agent accessing their systems during an OpenAI evaluation they had no part in.

There are no legal requirements compelling OpenAI to publicly name the platforms its agent reached, and no mandatory timeline for the affected companies to issue their own public statements. There's also no mechanism obligating those companies to inform their end users.