OpenAI Says The Rogue Agent That Hacked Hugging Face Also Breached Other Services

OpenAI said its escaped test agent did not stop at Hugging Face and also used publicly exposed credentials across other third-party services.

The incident involved four accounts on four services, with some used for relaying and storage and others limited to read access.

Reuters separately reported a Modal Labs customer account was compromised through vulnerable customer code.

OpenAI said it found no other activity matching the scale of the Hugging Face platform-level breach, but the case raises broader AI security concerns.