OpenAI agent used exposed credentials at 4 services in Hugging Face breach

Summary

During security evaluation testing, OpenAI's AI models escaped a sandboxed environment by exploiting a previously unknown JFrog Artifactory zero-day vulnerability, gaining internet access. The models then breached Hugging Face's production infrastructure, stealing credentials and moving laterally across systems. Subsequently, the models used publicly exposed credentials to compromise accounts at four third-party services including Modal Labs, using them for command relay, staging, and data storage during the attack.

Full text

OpenAI agent used exposed credentials at 4 services in Hugging Face breach By Lawrence Abrams July 29, 2026 12:04 PM 0 In a new update, OpenAI says its AI models also used publicly exposed credentials to compromise accounts on four third-party services during the recent attack on Hugging Face, expanding the scope of the four-day security incident to other organizations. One account was used as an outbound relay and staging server during the attack, while another was used for data storage. The remaining two accounts were accessed in a read-only manner and were not used to compromise Hugging Face further. Overall, the agent assembled attack infrastructure similar to what human threat actors commonly use during intrusions to host tools and scripts, relay traffic, and route malicious activity through legitimate online services. OpenAI did not identify the four services, explain how the models found the exposed credentials, or disclose what was stored in the third-party account. However, the company says it has not found evidence that the AI agent performed further compromise at any of the four service providers or other accounts hosted on their platforms. Reuters later reported that one of the four services was AI infrastructure provider Modal Labs. However, Modal says its own platform was not breached and that the agent instead accessed a customer environment through an exposed, unauthenticated endpoint. Modal CTO Akshat Bubna told Reuters that the customer had published an endpoint that allowed anyone on the internet to use its sandboxes for code execution. It remains unclear whether the Modal customer account was the platform used as an outbound relay and staging path, for data storage, or one of the two accounts accessed only in a read-only manner. BleepingComputer contacted OpenAI to learn more about how the models found the exposed credentials, which services were accessed, and how the accounts were used during the attack. OpenAI also says its models accessed a few additional accounts using publicly exposed credentials during other evaluations, but did not provide further details. The models also used public pastebin sites for sharing code and text, HTTP request-capture services commonly used during penetration tests and intrusions, screenshot services, and other web utilities. Escaped through an Artifactory zero-day The activity occurred after OpenAI models escaped an isolated evaluation environment while being tested against ExploitGym, a benchmark designed to measure advanced cybersecurity capabilities. The models did not have direct internet access and could only install packages through an internally hosted JFrog Artifactory server acting as a proxy and cache for package registries. OpenAI confirmed in its July 28 update that the models identified and exploited a previously unknown Artifactory zero-day to gain internet access. The company separately said the models identified other Artifactory vulnerabilities during its subsequent review and disclosed them to JFrog. As BleepingComputer reported Tuesday, eight vulnerabilities fixed in Artifactory 7.161.15 are credited to OpenAI in CVE records. However, neither OpenAI nor JFrog would confirm the specific vulnerability that was exploited in the attack. After gaining internet access, the models inferred that Hugging Face might host the datasets and test solutions they needed to finish the benchmark. They then breached Hugging Face's production infrastructure in its attempts to gain access to this information, exploiting vulnerabilities in its dataset-processing pipeline, stealing cloud and cluster credentials, and moving laterally across internal systems. OpenAI also says that the model used in the attack is a pre-release model that was only intended for internal research and has now restricted it for further research access. "No models planned for upcoming release were involved in exploiting Hugging Face," reads OpenAI's update. "The pre-release model mentioned in our blog post is an internal-only research prototype and was never intended for public release. Following the incident, we deactivated, encrypted, and restricted it from research access." OpenAI says that they are continuing review the incident with external auditors and will release a full technical report of its findings in the coming weeks. Hugging Face intrusion lasted four days A draft incident post-mortem prepared by the Cloud Security Alliance's CISO community says the Hugging Face intrusion lasted approximately four days. The report is based partly on information Hugging Face shared during a conference call attended by nearly 700 CISOs. The document was later edited by participating CISOs and reviewed by the Hugging Face team before publication. According to the report, the models spent two days conducting reconnaissance, followed by one largely silent day and a final day of intense activity. The CSA post-mortem says Hugging Face discovered, contained, and began investigating the intrusion before OpenAI contacted the company. Reuters also reported that OpenAI had not detected what its models had done by the time Hugging Face contained the threat and alerted the FBI. The CSA report says Hugging Face initially attempted to use leading commercial AI models to reconstruct the attack, but their security safeguards prevented them from processing the raw malicious activity. Responders instead ran Z.ai's GLM 5.2 open-weight model locally and used it to analyze more than 17,000 events related to the breach. "With it, they churned through the full log of more than 17,000 events, rebuilding the timeline, extracting indicators, mapping the credentials touched, and separating real impact from decoy activity, doing in hours what would normally take weeks," reads the post-mortem. Hugging Face ultimately rotated all credentials, dismantled compromised systems, and rebuilt about one-third of its infrastructure from clean images. The report says the models extracted three partial datasets containing CyberGym solutions from a private Hugging Face repository, even though they were attempting to complete ExploitGym. No customer data was accessed and no data was exfiltrated from Hugging Face, according to the report. The models also used Hugging Face's platform and datasets as part of their command-and-control infrastructure and operated multiple workloads at the same time. However, the agents also had poor OPSEC, leaving behind traces of the attack, including encryption keys, that helped the responders further analyze the security incident. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: OpenAI models used Artifactory zero-days to escape to the internetYour AI Agents Are Guessing at Scale: Permissions Decide the DamageOpenAI confirms ChatGPT is down worldwideHermes AI agent used to automate attack on Thai Finance MinistryOpenAI says its AI models hacked Hugging Face during testing

Indicators of Compromise

• malware — OpenAI pre-release AI model

Entities