OpenAI says the rogue agent that hacked Hugging Face also breached other services - Engadget

The agent used publicly available credentials to gain access to other services. OpenAI has updated its blog post about the rogue agent that breached Hugging Face and admitted that it also infiltrated other other third-party accounts and services to achieve its goal. In the updated post, the company said it has been finding "a small number of cases where the models identified and used publicly exposed credentials at the account-level on other publicly-available services" during its ongoing review. So far, it has determined that the rogue agent used the credentials of "four accounts" to infiltrate "four services" as part of the Hugging Face incident. It also said that it accessed a "few accounts" as part of other evaluations. "One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage," it explained. "The remaining two accounts were accessed by the models in a read-only manner, and were not used in furtherance of compromising Hugging Face." While the company didn't mention any names, Reuters has reported at the same time that the agent also compromised a customer's account at New York-based Modal Labs. Specifically, it exp

Jul 29, 2026 → Aug 18, 2026