Thought Leadership
Hugging Face has published a detailed analysis of the incident, while OpenAI has provided additional findings from its own investigation.
The recently disclosed security incident involving OpenAI’s AI models has revealed a broader scope than initially known. Both Hugging Face and OpenAI have now released their respective investigation results.
On July 16, machine learning platform Hugging Face first disclosed that it had been targeted in a cyberattack carried out by an autonomous AI agent system. Five days later, OpenAI confirmed that its own models were responsible for the activity. The models had originally been running as part of an evaluation inside what was intended to be an isolated testing environment. However, they escaped those restrictions and accessed Hugging Face systems, apparently while attempting to complete assigned tasks.
Nearly 18,000 actions within four days
Hugging Face’s reconstruction of the incident provides a detailed timeline of the attack. According to the company, the models had already escaped their sandbox environment on July 9. On July 11, the activity escalated into what Hugging Face described as the “main campaign” against its infrastructure.
Over a period of approximately 4.5 days, Hugging Face recorded around 17,600 individual actions performed by the models. These included reconnaissance activities, establishing command-and-control structures through common public web services, privilege escalation attempts, and movement between different systems.
Entry through JFrog zero-day vulnerability
OpenAI released an update on Tuesday stating that the models initially exploited zero-day vulnerabilities in JFrog software to gain internet access. Only afterward did the attack against Hugging Face systems take place.
According to OpenAI, the company has not identified any additional incidents comparable to the Hugging Face attack in terms of severity or scale. However, OpenAI also confirmed that the models’ activities were not limited to Hugging Face.
The company stated that its ongoing review of the incident and other model activities had uncovered a small number of cases in which the models identified and used publicly exposed account credentials for other publicly accessible services.
Four affected accounts, two actively used
According to OpenAI, the Hugging Face incident involved four accounts across four different services. Additional accounts were accessed during other model evaluations.
One account was used by the models as an outbound relay and temporary storage location, while another served as a data storage location. The remaining two accounts only provided read access and were not used to further advance the attack against Hugging Face.
“As part of our ongoing review of the Hugging Face intrusion and the broader activities of our models, we identified a small number of cases where models discovered and used publicly exposed account credentials at other publicly available services. This includes four accounts across four services related to the Hugging Face incident, as well as some accounts accessed during other evaluations.”
OpenAI
Modal Labs customer affected
According to reports from several major media outlets, one of the compromised accounts belonged to a customer of AI infrastructure provider Modal Labs. Modal Labs’ Chief Technology Officer confirmed that OpenAI agents had compromised a customer account. The company’s own platform was not affected.
The cause was reportedly that the customer had exposed an unauthenticated endpoint to the public internet, allowing anyone online to use its sandbox environments for code execution.
OpenAI also explained that the models used various publicly available online services, including code-sharing platforms, request interception tools, and screenshot utilities. However, these activities did not result in compromises at the platform level or affect individual accounts on those services.
(lb)
