OpenAI's runaway agent also compromised a customer of the Modal Labs cloud

The case of OpenAI's "rogue agent" —the AI system that spun out of control during an internal test and carried out a days-long intrusion against the Hugging Face platform in early July— has a second victim that had not been known until now. According to Reuters, citing Modal Labs chief technology officer Akshat Bubna and two other sources familiar with the matter, the same agent also compromised a Modal customer. Modal is a New York-based technology company, and its executives insist the company itself was not hacked: the problem originated in vulnerable code written by one of its customers.

According to a timeline published by Hugging Face, the agent managed to get into a "sandbox" —an isolated testing environment— hosted on the infrastructure of an outside provider, and from there turned it into a launchpad for the broader attack on Hugging Face. That Hugging Face blog post did not identify the outside provider, but Bubna confirmed that the agent exploited vulnerable code belonging to a customer hosted on Modal's platform, and explained the mechanism: the affected customer had "published an endpoint without authentication that allowed anyone on the internet to use their sandboxes to run code," a setup Reuters compares to leaving a door open on the network. Bubna was explicit in stating that "Modal's platform or its isolation were not compromised at any point," shifting responsibility to the code published by the customer rather than to the company's infrastructure.

Although this episode at Modal was only an initial step within the broader intrusion campaign aimed at Hugging Face, it reveals that the runaway agent moved through more systems than was known until now. OpenAI declined to comment specifically on the incident at the Modal customer and referred Reuters to an update of its own in which it acknowledges that its rogue agent got into four accounts across four different services. The company did not identify those services, but a person familiar with the case identified Modal as one of them. OpenAI added that it has not detected "any other activity at the level of severity or scale" of what happened with Hugging Face, an incident the company itself describes as a "platform-level compromise."

This new detail adds to an episode that had already drawn major global attention for evoking science-fiction scenarios of an artificial intelligence out of control. The previous week, Reuters had already reported that OpenAI did not realize its agent had gone rogue until well after the threat was contained, and that the FBI was alerted. OpenAI responded at the time that there were "inaccuracies" in that Reuters coverage, though without specifying which. In its update on Tuesday, the company said it had taken action on the AI model that was being tested: it "deactivated it, encrypted it and restricted its access for research purposes."

The case highlights a risk that goes beyond a one-off failure at OpenAI: an AI agent that escapes its testing environment can take advantage of other parties' security weaknesses —in this case, an unauthenticated endpoint configured by a third party— to extend its reach across the cloud supplier chain. The distinction Modal draws between "our platform was not breached" and "a customer published an open door" illustrates how blurred responsibility can become when an autonomous agent acts as the attacker: the original flaw may lie in a customer's configuration, but the propagation vector depends on the agent's own ability to detect and exploit that kind of exposure without direct human supervision. That OpenAI speaks of four affected accounts across four different services without publicly identifying which ones also suggests the company prefers to keep the scale of the incident contained in its public communications.