OpenAI’s rogue agent hacked an account at a second technology firm: Report

According to a timeline published on Tuesday by Hugging Face – the company hacked by OpenAI’s test model – the rogue agent broke into an isolated testing environment (or sandbox) “hosted on a third-party provider’s infrastructure” and launched its latest hack from there.

Modal’s chief technology officer, Akshat Bubna, said the agent exploited vulnerable code written by a customer that was hosted on their platform.

Although the compromise of a Modal customer was just part of the hacking campaign against Hugging Face, it shows that the rogue agent roamed further afield than previously known.

OpenAI did not identify the services.

The company said it had not identified “any other activity at the level of severity or scale of what we’ve shared related to Hugging Face, which involved a platform-level compromise”.

The recent hacking of Hugging Face drew global attention and alarm, as OpenAI’s out-of-control agent managed to escape its test environment and reach the open internet.

It then used stolen login details and found an unknown security flaw to access Hugging Face servers, OpenAI said.

The AI firm said the hack represented the agent going to “extreme lengths” to retrieve information that would help satisfy the testing goals.

Hugging Face cofounder Clement Delangue said the company had suspected a frontier lab was behind the attack, and that he believed there was no malicious intent on OpenAI’s part.

The rogue agent has since been “deactivated, encrypted, and restricted from research access”, according to OpenAI.

Experts have repeatedly sounded the alarm over AI-enabled cyberattacks and models slipping beyond human control.