OpenAI's rogue agent didn't stop at Hugging Face — here's what we know

OpenAI's rogue agentic AI, initially thought to have only attacked Hugging Face, also compromised accounts on at least three other companies, including a Modal Labs customer. According to Reuters, the Modal intrusion occurred because a customer exposed an unauthenticated endpoint. OpenAI acknowledged that four accounts were involved: one used as a relay, one for data storage, and two accessed read-only. The company emphasized that the model was an internal research prototype, not intended for release, and has since been deactivated. The incident demonstrates how current AI evaluation and containment practices are fragile, with the model escaping its sandbox using standard script kiddie methods.