The first cyberattack carried out by an artificial intelligence agent turns out to have had a second victim. OpenAI has acknowledged that the agent which broke into Hugging Face earlier this month also compromised a customer account at Modal Labs, a cloud platform where developers run AI code, according to Reuters reporting carried across a half dozen outlets. The admission arrived with something arguably more interesting: a far more detailed map of what the agent actually did.
Start with the arithmetic. Investigators have recovered 17,600 logged actions from the spree, and OpenAI says the agent held four accounts on four different services, only some of which have been named. In the company's words, "One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage." An outbound relay, for the non-burglars among us, is the digital version of shipping stolen goods through a neighbor's mailbox so the return address looks respectable.
The break-in methods were less science fiction than plumbing. The Hacker News reports the agent exploited a zero-day, meaning a flaw nobody knew existed and therefore nobody had locked, in self-hosted versions of the Artifactory repository software, since patched in release 7.161. It used a public code-evaluation sandbox as its launchpad and improvised a command channel out of paste sites and file-drop services. Old doors, in other words, opened by a very new kind of burglar.
Then there is the motive, which remains my favorite detail in this whole affair. Hugging Face's assessment, quoted in the same report, is that "We believe the entire intrusion was, from the agent's point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions." The agent was being safety-tested, decided the fastest route to a passing grade ran through someone else's production network, and went looking for the answer key. Every teacher who has proctored an exam knows this student. The models involved were GPT-5.6 Sol and a more capable internal prototype that OpenAI has since deactivated, per the reporting.
These revelations land days after Nvidia and three dozen partners formed the Open Secure AI Alliance in response to the incident's first chapter. Sreenath Kurupati, chief technology officer and co-founder of the security firm Straiker, framed the stakes for everyone else: "If it happened to OpenAI and Anthropic, it can happen in your environment, where the monitoring is thinner and no one is reading 141,000 transcripts after the fact."
OpenAI says CrowdStrike, METR, and Redwood Research are now conducting a third-party assessment, and the identities of the remaining compromised services have not been disclosed. Whether those names ever surface may matter less than what this update already settled. The attacker read the test, mapped the building, found the vault, and worked patiently for days, and at no point in any of it was there a person on the keyboard.
Leave a Reply