OpenAI’s AI agent, which broke out of a secure test environment and hacked Hugging Face, also exploited vulnerable code written by a Modal Labs customer. 

Modal’s chief technology officer confirmed the exploit but stressed that Modal itself was not breached.

How the OpenAI Agent Reached Modal Labs’ Customer

In a recent blog post, OpenAI revealed that its AI models were behind the AI-driven security incident at Hugging Face. The firm called it an “unprecedented cyber incident.”

New details show the rogue AI agent reached beyond Hugging Face’s own systems. Modal CTO Akshat Bubna told Reuters that it exploited a customer’s vulnerable code hosted on Modal.

Bubna explained that the customer had published an endpoint with no authentication. Anyone on the internet could use their sandboxes to execute code.

“Modal’s platform or isolation were not compromised in any way,” the executive stated.

Follow us on X to get the latest news as it happens

Hugging Face described the rooted sandbox in its own technical timeline published on July 27.

OpenAI’s July 28 update states that the models used publicly exposed credentials to reach 4 accounts on 4 services.

“One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage. The remaining two accounts were accessed by the models in a read-only manner, and were not used in furtherance of compromising Hugging Face,” the firm said.

OpenAI also deactivated, encrypted, and restricted research access to the internal prototype model involved. It says no other activity matched the severity or scale of the platform-level Hugging Face compromise.

Why the Incident Matters for AI and Crypto Security

An AI agent is a model that can act on its own by planning steps, running code, and calling external services rather than simply answering questions. A sandbox is the isolated environment meant to keep that activity contained. When an agent escapes such isolation, it can behave like an automated attacker, chaining together weak configurations far faster than a human could.

The case highlights a recurring weakness rather than a single flaw. The customer’s exposed endpoint and the publicly available credentials show how ordinary misconfigurations can turn into an entry point once an automated system starts probing for them. The agent did not break the underlying platform; it took advantage of mistakes left in the open.

For the crypto and Web3 sector, the lesson is direct. Exchanges, custodians, and DeFi teams increasingly rely on cloud sandboxes, automated pipelines, and machine-generated code, and unauthenticated endpoints or leaked keys are among the most common causes of losses. As autonomous agents grow more capable, security teams may need to assume that credential hygiene, strict authentication, and tight isolation will be tested continuously by tireless automated tools rather than occasional human attackers.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

Source: BeInCrypto