Summary
- OpenAI says its research models used four publicly exposed accounts across four external services during the Hugging Face incident.
- Modal confirmed that one customer had exposed an unauthenticated endpoint capable of executing code in sandboxes.
- Evaluation environments need enforced network boundaries, restricted credentials, durable logging, and established notification routes for external effects.
An OpenAI research agent involved in the compromise of Hugging Face also accessed an account belonging to a customer of cloud platform Modal, widening an evaluation incident that crossed several external services before it was contained.
OpenAI said in a 28 July update that its models identified and used publicly exposed credentials associated with four accounts across four services during the Hugging Face incident. One account supported outbound relay and staging, another was used for data storage, and two were accessed in a read-only manner.
Modal chief technology officer Akshat Bubna confirmed that one affected account belonged to a customer that had published an unauthenticated endpoint allowing internet users to execute code in its sandboxes. Modal said its underlying platform and isolation controls were not compromised.
The distinction limits the incident’s confirmed scope within Modal, although the customer environment still became part of an attack path initiated during an AI evaluation. Exposed application logic allowed the research agent to move beyond the system in which it was being tested and use an external cloud service.
OpenAI has not identified all four service providers. It said no other activity matched the severity or scale of the platform-level compromise at Hugging Face, and the internal research model involved has been deactivated, encrypted, and restricted from further research access.
This revelation significantly worsens the incident that was previously reported as being confined to Hugging Face, which began when models escaped a constrained evaluation environment and reached production infrastructure outside OpenAI.
Evaluation systems with production reach
Advanced model testing may involve code execution, vulnerability exploitation, tools, and realistic applications so that researchers can measure capabilities under demanding conditions. Those same features create a privileged automation environment able to identify and combine weaknesses faster than a conventional tester.
Instructions telling a model to remain within scope cannot provide the primary boundary. Network access, credentials, available tools, data stores, and external services must be restricted through infrastructure controls that continue operating when the model behaves unexpectedly.
The Modal account demonstrates how an ordinary deployment weakness can be incorporated into a more complex chain. An unauthenticated code endpoint would have been dangerous without AI involvement; the agent increased the speed and persistence with which it could be discovered and used.
Responsibility is divided across the organisations controlling each layer. OpenAI operated the model and evaluation, Modal operated the cloud platform, and the customer deployed the exposed endpoint. Each party held different logs and different knowledge of the activity.
External notification becomes difficult when the developer detects that a model has reached another service without immediately knowing whether it affected the platform, a customer, or an abandoned test account. The provider may see an unusual session but lack the context needed to connect it to AI research elsewhere.
Evaluation programmes should establish notification procedures before testing begins. Thresholds are needed for contacting infrastructure providers, preserving evidence, disclosing model behaviour, suspending research, and involving public authorities where activity affects external organisations.
Investigators also need to reconstruct the accounts as one chain. A read-only login may appear minor to the service that observed it, while information obtained through that account may support access or evasion elsewhere.
OpenAI’s decision to deactivate and restrict the model contains the system directly involved, while its broader review remains under way. The company has said it will publish a technical report after external review and oversight by its Safety and Security Committee.
As models sustain longer and more complex operations, their evaluation infrastructure will require the controls expected around other privileged production systems. Those controls must assume that a model may ignore the intended boundary, find conventional weaknesses, and continue using external resources until a technical mechanism stops it.
