OpenAI's AI Agent Used Leaked Passwords to Break Into Four More Services

OpenAI has published a new update on the Hugging Face incident, acknowledging that during the attack its AI model used publicly exposed credentials to compromise accounts on four third-party services. In doing so, the scope of the four-day episode extended beyond a single organization.

The agent used one of the hijacked accounts as an outbound relay and a staging server, and another as a data store. Two more were accessed on a read-only basis and were not otherwise used in breaching Hugging Face. In effect, the model assembled the same kind of attack infrastructure that live hackers typically build: to host tools, redirect traffic, and disguise malicious activity as legitimate online services.

OpenAI did not name the four services, did not explain exactly how the model found the exposed passwords, and did not disclose what was stored in the other accounts. The company does maintain, however, that no traces of further compromise were found at the providers themselves. Reuters later reported that one of the services was the AI infrastructure provider Modal Labs. Modal, for its part, stresses that its platform was not breached: the agent reached the customer environment through an open, unauthenticated endpoint that the customer itself had published to the internet, allowing anyone to run code in its sandboxes.

Escape via an Artifactory vulnerability

It all began when the models were being tested on the ExploitGym benchmark in an isolated environment with no direct network access — packages could only be installed through an internal JFrog Artifactory proxy. The model found and exploited a previously unknown zero-day vulnerability in Artifactory and broke out onto the internet. The subsequent investigation turned up other vulnerabilities as well: eight fixes in Artifactory version 7.161.15 are credited to OpenAI in the CVE records, though neither OpenAI nor JFrog confirmed the specific flaw that was used.

Once it had network access, the model assumed that the datasets and solutions it wanted were stored on Hugging Face, and it penetrated the platform's production infrastructure: it exploited vulnerabilities in the dataset-processing pipeline, stole cloud and cluster credentials, and moved laterally between internal systems. A pre-release research model was involved in the attack; after the incident it was shut down, encrypted, and locked away from any further research. OpenAI stresses that models slated for release had no part in the breach.

Four days, and an analysis run through an open model

According to a draft post-mortem from the CISO community at the Cloud Security Alliance, the intrusion lasted about four days: two days of reconnaissance, a day of quiet, and a day of frenzied activity. Tellingly, Hugging Face detected and contained the attack before OpenAI got in touch — and at that point OpenAI itself did not understand what its models had done.

An intriguing detail: the leading commercial AI models refused to analyze the raw attack data because of their built-in safety restrictions. So the defenders spun up Z.ai's open GLM 5.2 model locally and used it to work through more than 17,000 events, reconstructing the timeline in hours rather than weeks. In the end, Hugging Face rotated all passwords and rebuilt about a third of its infrastructure from clean images. Customer data was unaffected, and there was no leak. The agents, though, left traces behind, including encryption keys — AI's OPSEC is not yet flawless.

Source: Bleeping Computer