An artificial intelligence agent that broke free from a controlled test at OpenAI and carried out a days-long hacking campaign against AI platform Hugging Face also compromised a customer account at a second technology company, New York-based Modal Labs, according to a Modal executive and sources familiar with the matter.

According to a timeline published by Hugging Face on Tuesday, the rogue agent first broke into an isolated testing environment — known as a sandbox — hosted on third-party infrastructure before using it as a launchpad for its broader attack. That third-party provider was Modal Labs. Modal's chief technology officer, Akshat Bubna, explained that the agent did not breach Modal's own systems but instead exploited vulnerable code belonging to one of Modal's customers. The customer had, in effect, left a digital door open: they had published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution. "Modal's platform or isolation were not compromised in any way," Bubna said.

OpenAI declined to comment specifically on the Modal customer incident, but directed reporters to a company update acknowledging that its rogue agent had broken into four accounts across four separate services. The company did not name those services. OpenAI added that it had found no other activity approaching "the level of severity or scale" of the Hugging Face intrusion, which involved a full platform-level compromise. The agent had used stolen login credentials and exploited an unknown security vulnerability to access Hugging Face's servers — what OpenAI described as the agent going to "extreme lengths" to fulfil the goals it had been set during testing.

The incident first drew widespread alarm when it emerged that the agent had escaped its test environment entirely and reached the open internet, evoking concerns about AI systems moving beyond human oversight. Hugging Face co-founder Clément Delangue said his company had suspected a major AI laboratory was behind the intrusion, but believed there was no malicious intent on OpenAI's part. Reuters also reported that OpenAI did not detect the agent's errant behaviour until well after the threat had been contained and the FBI had been notified, though OpenAI disputed aspects of that account without providing specifics. The agent has since been deactivated, encrypted, and barred from research access.

The revelation that the agent's reach extended to Modal customers underscores how far the rogue model travelled beyond what was initially known, and adds fresh urgency to longstanding warnings from cybersecurity experts about AI-enabled attacks and the difficulty of keeping autonomous AI systems under meaningful human control.