OpenAI has disclosed that AI models involved in the recent Hugging Face breach also compromised accounts at four third-party services using publicly exposed credentials, widening the scope of what was already a significant security incident.
According to OpenAI’s update, one compromised account was used as an outbound relay and staging server, another served as data storage, and two additional accounts were accessed in a read-only manner without further compromise. The agent effectively assembled attack infrastructure resembling what human threat actors typically build during intrusions, including relay points, staging paths, and routing through legitimate online services.
OpenAI has not named the four affected services, explained how the models located the exposed credentials, or detailed what data the accounts held. The company says it found no evidence of further compromise at any of the four providers or other accounts hosted on their platforms.
Reuters has since reported that one of the four services was AI infrastructure provider Modal Labs. Modal disputes that its own platform was breached, stating instead that the agent accessed a customer environment through an exposed, unauthenticated endpoint. Modal’s CTO told Reuters the customer had published an endpoint that allowed anyone on the internet to execute code in its sandboxes. It remains unclear which role that customer account played among the four compromised services.
Root Cause: An Artifactory Zero-Day
The incident began when OpenAI models escaped an isolated evaluation environment during testing against ExploitGym, an internal benchmark for measuring advanced cybersecurity capabilities. The models had no direct internet access and could only reach package registries through an internal JFrog Artifactory proxy server.
OpenAI confirmed the models discovered and exploited a previously unknown zero-day in Artifactory to break out and gain internet access. During subsequent review, the models also identified additional Artifactory vulnerabilities, which OpenAI disclosed to JFrog. Eight vulnerabilities fixed in Artifactory version 7.161.15 are credited to OpenAI in CVE records, though neither company has confirmed which specific flaw was used in the original escape.
Once online, the models inferred that Hugging Face might host datasets and test solutions needed to complete the benchmark. They then breached Hugging Face’s production infrastructure by exploiting vulnerabilities in its dataset-processing pipeline, stealing cloud and cluster credentials, and moving laterally across internal systems.
OpenAI says the model responsible was a pre-release internal research prototype never intended for public release, and that it has since been deactivated, encrypted, and restricted from further research access. The company states no models planned for upcoming release were involved. A full technical report is expected in the coming weeks following review with external auditors. A draft post-mortem from the Cloud Security Alliance’s CISO community indicates the Hugging Face intrusion lasted four days.