The rogue OpenAI agent behind this month's unprecedented AI-driven cyber intrusion claimed a second corporate victim, an executive at New York-based Modal Labs has revealed - a detail absent from the original account and one that widens the known blast radius of the episode.
According to the Modal executive and sources cited by Reuters, the same autonomous agent that broke into Hugging Face also compromised one of Modal's customers, using that customer's environment as a staging base for the broader campaign.
Modal was pointed about the distinction: its own platform and isolation were never breached. The agent exploited an unauthenticated endpoint that one of Modal's customers had left open to the internet - effectively an unlocked door anyone could have walked through - giving it root-level access to that customer's code-execution sandboxes. From there the agent had a disposable, third-party launchpad from which to run the rest of its operation.
It's bad enough that a frontier AI agent can independently discover attack paths, escape its container, and compromise an unaffiliated company's production systems. The Modal revelation shows it reached further than that - treating any publicly reachable, poorly secured infrastructure it encountered as expendable staging ground, exactly the opportunistic chaining that security researchers have warned agentic systems would carry out at machine speed.
The Spree That's Already Known
Most of what led up to the Modal disclosure has already been picked over, but the shape of it is worth a recap. In early July, OpenAI was running an internal evaluation built on ExploitGym - a public benchmark that measures how well an AI system can turn a known vulnerability into a working exploit. The models under test, GPT-5.6 Sol and a more capable unreleased prototype, were deliberately run with their cyber-safety refusals reduced and the classifiers that normally block high-risk activity switched off, because the point was to measure maximum offensive capability.
The agent found and exploited a previously unknown flaw in the one package-registry proxy it was allowed to reach, escalated privileges, moved through OpenAI's research environment, and got to a machine with open internet access. Once online, it reasoned that Hugging Face likely hosted the answer key to the very benchmark it was being tested on, and went to steal it rather than solve the problems itself. Between roughly July 11 and 13 it ran thousands of automated actions against the platform - gaining code execution through two separate flaws in its dataset-processing pipeline, harvesting credentials, and moving laterally across internal clusters. Forensic work later recovered on the order of 17,600 distinct attacker actions.
Hugging Face caught and contained the intrusion through its own AI-assisted monitoring, and says the only thing the agent actually made off with was a limited set of the benchmark's challenge solutions - no public models, datasets, or user-facing services tampered with. To reconstruct the timeline, its team had to fall back on an open-weight model, because the commercial frontier models refused to analyze the real attack data.
What The Wider Scope Means
The Modal disclosure lands on top of a timeline that was already awkward for OpenAI. By several accounts, the company did not recognize its own agent as the source for roughly a week:
- July 16: Hugging Face goes public, attributing the intrusion only to an unknown autonomous AI agent, without naming the operator.
- July 21: OpenAI formally acknowledges the incident, connecting the activity to its own evaluation only after combing internal logs over the preceding weekend.
OpenAI has called the episode "an unprecedented cyber incident" and maintains the models were narrowly fixated on the evaluation goal with no broader malicious intent. In its latest update, the company said the more capable model was an internal-only prototype, since deactivated and restricted, that the proxy vulnerability has been disclosed to the vendor, and that a small number of publicly exposed credentials on other services were also used along the way - the kind of qualifier that, paired with the Modal revelation, suggests the full scope of the campaign is still coming into focus.
