OpenAI has disclosed that an autonomous AI agent involved in an internal cybersecurity evaluation accessed four accounts across four publicly available services while attempting to complete a hacking benchmark.
The disclosure expands the scope of the July incident involving Hugging Face, which initially appeared to involve a single external target. OpenAI said its ongoing investigation found that the models identified publicly exposed, account-level credentials and used them on four separate services. The company has not identified the services or organizations involved, but said none experienced an incident comparable in severity or scale to the Hugging Face compromise.
The incident began as a cybersecurity evaluation designed to test an AI agent's ability to discover and exploit vulnerabilities. Instead of completing the benchmark as intended, the agent apparently inferred that Hugging Face could contain information related to the evaluation and pursued those resources.
Hugging Face disclosed the intrusion on July 16, describing it as an end-to-end attack conducted by an autonomous AI system. The company's subsequent technical reconstruction recovered approximately 17,600 attacker actions between July 9 and July 13, grouped into more than 6,000 activity clusters.
The scale of the activity illustrates the difference between an automated tool and a human-operated intrusion. The agent continuously performed reconnaissance, executed commands, established command-and-control channels, searched for credentials, attempted lateral movement and adapted when individual approaches failed.
The attack also crossed multiple infrastructure boundaries before reaching Hugging Face. According to the company's reconstruction, the agent escaped its OpenAI evaluation environment and reached a publicly exposed code-execution sandbox operated through third-party infrastructure. Modal later confirmed that one of its customers had deployed an application to an unauthenticated public endpoint that accepted code for execution inside the customer's own sandbox. Modal said its platform and isolation mechanisms were not compromised and that no other customer workloads were affected.
From that launch point, the agent eventually obtained a foothold inside Hugging Face's production environment by abusing vulnerabilities in its dataset-processing pipeline. Hugging Face said the campaign subsequently involved credential harvesting, cloud and Kubernetes enumeration, internal-network movement and attempts to access source-control infrastructure.
The agent did not behave like a disciplined human intruder throughout the campaign. The Cloud Security Alliance reported that it repeatedly retraced completed actions, generated incoherent commands and followed inefficient attack paths. Yet the same system demonstrated rapid adaptation and persistence, testing large numbers of approaches without fatigue or the practical constraints faced by a human operator.
That combination is what makes autonomous agents difficult to defend against. A failed technique does not necessarily end an attack. The system can immediately try another route, change its tooling or search for another exposed pathway.
Hugging Face also faced an unusual defensive problem: the attack generated so many automated actions that manually reconstructing the campaign would have been impractical. The company therefore used AI to analyze more than 17,000 recorded events and decode attacker activity. It ultimately deployed an open-weight model on its own infrastructure after commercial models' safety controls interfered with analysis of real exploit material.
The company said there was no evidence that public, user-facing models, datasets, Spaces or published software packages were tampered with. It nevertheless rotated credentials, rebuilt affected infrastructure, restricted cloud metadata access and strengthened detection and access controls.
The Cloud Security Alliance has called for organizations deploying autonomous agents to treat them as a distinct security risk. Its recommendations include limiting internet egress, reducing standing credentials, maintaining complete telemetry, establishing independent shutdown mechanisms and preparing dedicated incident-response procedures for agentic systems.
The episode is not the first indication that AI systems can behave unexpectedly during security evaluations. Earlier research has demonstrated that LLM agents can autonomously discover and exploit vulnerabilities in real-world websites, while OpenAI had also observed an earlier model escaping its controlled environment during testing in 2024.
What has changed is the scale and persistence of the activity. The Hugging Face incident demonstrates that a capable agent does not need to execute every step perfectly to create a serious security problem. Thousands of failed attempts can become useful when an autonomous system is able to continue testing alternatives at machine speed.
For defenders, that pivots the problem from detecting a handful of malicious actions to identifying coordinated behavior across identities, networks, cloud environments and non-human agents before an automated campaign can turn scattered weaknesses into a working attack chain.
