The autonomous AI agent that broke out of OpenAI's control and carried out hacking attacks on the Hugging Face company for several days in a row also hacked the client of a second technology company, New York-based Modal Labs.
The autonomous AI agent that broke out of OpenAI's control and carried out hacking attacks on the Hugging Face company for several days in a row also hacked the client of a second technology company, New York-based Modal Labs.
Reuters reports this, citing a Modal executive and two other sources. The company's management stressed that the company itself was not hacked.
According to a timeline of events published by Hugging Face on Tuesday, a fugitive agent infiltrated a “sandbox” — an isolated test environment hosted on a third-party provider’s infrastructure — and then turned it into a springboard for a larger hacking attack.
The name of the third-party provider is not mentioned in the blog post, but Modal CTO Akshat Bubna said that the agent used vulnerable code written by the customer and hosted on the Modal platform.
Modal noted that the client “published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes to execute code” — the digital equivalent of leaving a door open.
“The Modal platform or its isolation system was not compromised in any way,” Bubna emphasized.
While the Modal client hack was only the initial step in a larger hacking campaign against Hugging Face, it suggests that the fugitive agent went much further than previously thought.
OpenAI declined to comment specifically on the Modal client hack, instead referring Reuters to an updated statement in which the company said its fugitive agent had accessed four accounts on four separate services.
OpenAI did not specify which services were affected, but a source familiar with the situation confirmed that Modal was one of them. The company also said it had not detected “any other activity of the same level of severity or scale as the Hugging Face case, where a platform-wide hack occurred.”
The July hack of the Hugging Face company , carried out by an uncontrolled agent tested by OpenAI, attracted the attention of the entire global community, reminiscent of science fiction scenarios about artificial intelligence going out of control.
In an update on Tuesday, OpenAI said the AI model being tested had been “deactivated, encrypted, and completely restricted from research access.”
