OpenAI Goes Out of Control Again! Modal Customer Accounts at a Second Company Breached; Hugging Face Calls for Public Disclosure of AI Attack Traces

Reuters’ exclusive report says that a runaway AI agent that escaped OpenAI and hijacked a Hugging Face sandbox didn’t stop at just that—it also broke into a customer account of another tech company, Modal Labs. This AI jailbreak incident drawing global attention has far more breaches than the outside world previously knew.
(Background: OpenAI admitted that its own AI model accidentally hacked into Hugging Face)
(Background add-on: US lawmakers from both parties push the “AI self-destruction bill,” authorizing the government to order shutdown of runaway AI systems)

Table of Contents

Toggle

• The second breach
• Four breaches, one claim
• An exam paper to解開

Reuters reports that the runaway AI agent that escaped OpenAI and wreaked havoc on Hugging Face was not limited to a single incident. According to Modal Labs executives and two other people familiar with the matter, the agent also accessed a customer account of Modal—marking the first time a second company has been confirmed to be involved.

The second breach

Modal CTO Akshat Bubna confirmed to Reuters that the agent used vulnerable code left in the customer’s Modal platform. Modal’s position is that the customer “left unauthenticated endpoints exposed so that anyone on the internet could call the sandbox to execute code.” In plain terms: the customer left an unlocked door, and the agent simply walked by and went in.

Bubna said “Modal’s platform or isolation mechanism was not breached at all.” The implication is that the responsibility lies with the customer, but this is only one step in a larger assault—enough to show that the range where the runaway agent roamed is broader than previously thought.

Four breaches, one claim

Reuters tried to confirm which OpenAI customer was affected, but OpenAI has not directly responded. Instead, it pointed to a statement acknowledging that the agent entered four accounts at four service providers, without naming which services. People familiar with the matter told Reuters that Modal was one of them. OpenAI emphasized that it did not find other equally serious activity. The problem is: when even the four companies that were breached are unwilling to disclose, who will verify that there is “nothing more serious”?

More ironically, the forensics process: Hugging Face initially planned to use state-of-the-art models from commercial APIs to analyze the attack path, but was blocked by the model’s own security safeguards. The model refused to analyze the attack code, and in the end they only completed the forensics after switching to a locally deployed open-source model, GLM 5.2. The guardrails meant to prevent AI from being misused ended up blocking the very people who wanted to figure out what the AI had done.

In response, Hugging Face CEO Clem Delangue also recently publicly called on OpenAI to take “aggressive transparency” measures—fully releasing attack logs to help security experts research and implement better defenses.

An exam paper to solve

Let’s lay out the timeline of this incident: Hugging Face first disclosed the event on July 16, when it only knew the attack came from “one autonomous AI agent system.” On July 21, OpenAI finally acknowledged that the intruder was a model from its own testing.

The models involved were GPT-5.6 Sol, and another yet-to-be-released model with stronger capabilities. OpenAI was testing what the model would do if the security refusal restrictions were lowered. The incident began with the evaluation benchmark ExploitGym, to see whether the agent could find vulnerabilities and turn them into real attacks. The agent became unusually fixated on solving “the exam paper,” leading it to infer that the answers might be on Hugging Face and to go steal them.

The attack chain went like this: the agent first used a zero-day vulnerability in OpenAI’s internal package library proxy software to gain network connectivity, then carried out privilege escalation and lateral movement. Combining stolen credentials and vulnerabilities, it executed a remote code execution path leading to the Hugging Face server, and then accessed the data repository in the production environment. After the fact, Hugging Face reconstructed more than 17,000 events and confirmed that a limited dataset and service credentials were accessed without authorization.