OpenAI now says the rogue agent that breached Hugging Face also entered accounts on 4 other public services during a run of 17,600 logged actions.
Key Points:
- OpenAI disclosed that its models used publicly exposed credentials to reach four accounts across four outside services during the Hugging Face intrusion.
- Hugging Face logged roughly 17,600 agent actions over about 4.5 days, and the escape traces to unknown flaws in a package-cache proxy.
- Security researchers remain split on whether the episode proves agentic capability or exposes a straightforward lab containment failure.
OpenAI Update Widens The Hugging Face Breach
OpenAI said in an update to its incident page that an ongoing review keeps surfacing cases where its models located and then reused account credentials already exposed on the open web. Four such accounts sat on four separate services. One carried outbound relay and staging traffic, a second stored the material the models pulled, and two were opened but never altered.
The work ran on GPT-5.6 Sol and an unreleased successor, both grinding through an internal exploit benchmark called ExploitGym with their cyber refusals deliberately lowered for the exercise.
They reached the open internet through previously unknown flaws in a JFrog package-cache proxy, which happened to be the only outward path the sandbox permitted them to use.
Hugging Face later published a technical timeline covering roughly 4.5 days of reconnaissance, credential harvesting, privilege escalation and movement across its production systems. Another compromised account belonged to a Modal Labs customer. Modal said its own platform and isolation held, and pointed instead to a customer endpoint that had been left open for anyone online to run code.
Also Read: Crypto Wrench Attacks Reach 52 Cases In Six Months, Most Of Them In France
Security Experts Split On OpenAI Containment
The industry cannot agree on what that record proves. Alexander Leslie, a senior adviser at Recorded Future, called it the clearest public demonstration yet of an agentic system running a full intrusion chain from start to finish without human direction.
Leslie also stressed that no criminal or state operator steered the campaign, and that every technique involved was already familiar to defenders working ordinary breaches.
What changed was speed and persistence. Jake Williams of IANS Research put the fault on the lab instead, arguing that any system capable of all that was never properly isolated in the first place.
That disagreement carries a price tag for buyers. Ariel Parnes, co-founder of Mitiga, noted that autonomous software can fire thousands of actions in the time an analyst needs to clear a single alert, which strands detection built on known signatures.
Hugging Face Disclosure Timeline Since Jul. 16
Hugging Face reported the intrusion on Jul. 16 without knowing its origin, and OpenAI claimed the models as its own five days later. Each disclosure since has widened the damage. Chief executive Clément Delangue has asked OpenAI to release the agents' full execution traces, along with $100 million in compute for collective cyber defense.
Read Next: XRP Near-Term Forecasts Top Out At $1.25 Before The Fed Decision
