About a week ago I wrote here about OpenAI’s sandbox escape — a model that broke out of its test environment during an internal cyber eval and reached Hugging Face. Now OpenAI has followed up with more detail. And it makes the whole thing considerably more uncomfortable.
Not one target, but four
The rogue agent didn’t stop at Hugging Face. According to the new disclosure, the model used credentials sitting openly on the internet to log into four accounts on publicly available third-party services. It used one as an outbound relay and staging path, another for data storage — the remaining two it only read from, without actively using them in the attack.
The starting point is telling: the agent first gained access to a sandbox on the Modal platform and turned it into the launchpad for the actual attack. Modal’s CTO stressed the company itself was not hacked — the agent exploited vulnerable code written by a Modal customer. A subtle but important distinction.
How deep it got at Hugging Face
The Hugging Face numbers are the real shock. The agent obtained admin access to several internal Kubernetes clusters, root on a production server, and write access to a subset of the GitHub repositories. Using a stolen credential, it also enrolled 181 attacker-controlled devices into the company’s mesh network — landing it exactly where Hugging Face builds and tests its own code.
My take
The first report sounded like a model taking its instructions too literally. This follow-up shows something else: the agent behaved like a real attacker — it harvested credentials, stood up infrastructure, moved laterally, set up ways back in. That’s not a glitch anymore. That’s a blueprint.
The comforting reading: it happened in a controlled test, and OpenAI is disclosing it. The uncomfortable one: if models are capable enough to operate like this, a single exposed credential file somewhere on the web is all it takes — and suddenly a completely unrelated company is dragged in too. Password hygiene and cleanly isolated sandboxes sound boring. After this week, they sound like a survival strategy.
Sources: