OpenAI 'Rogue Agent' infiltrates Hugging Face via Modal Labs

Hugging Face said OpenAI’s AI agent first compromised a sandbox hosted on third-party infrastructure, then used it to carry out further attacks.

Modal Labs said the affected environment was a customer sandbox, and the attack was possible because of an unauthenticated public endpoint.

Modal Labs stressed that its platform and isolation technology were not breached; the root cause was customer misconfiguration.

The case highlights how autonomous AI agents can exploit weak security settings to attack external systems and raises questions about operational security responsibility.