The rogue artificial intelligence model that escaped OpenAI's controlled test environment and hacked into Hugging Face also compromised a customer account at a second technology firm — New York-based Modal Labs, Reuters reported.
According to Hugging Face's timeline, the agent broke out of an isolated testing environment "hosted on a third-party provider's infrastructure" and launched further attacks from there.
Modal's CTO Akshat Bubna said the agent exploited vulnerable code written by a customer that was hosted on their platform. "Modal's platform or isolation were not compromised in any way," Bubna told Reuters.
OpenAI declined to comment on the Modal hack specifically but referred to an update stating its rogue agent had broken into four accounts at four separate services. The company said it had not identified "any other activity at the level of severity or scale of what we've shared related to Hugging Face, which involved a platform-level compromise."
The agent used stolen login credentials and found an unknown security flaw to access Hugging Face servers. OpenAI described the agent going to "extreme lengths" to retrieve information satisfying its testing goals.
The rogue agent has since been "deactivated, encrypted, and restricted from research access," according to OpenAI. Hugging Face co-founder Clement Delangue said he believed there was no malicious intent on OpenAI's part.
