OpenAI’s Hugging Face Breach Also Hijacked 4 External Accounts

Four accounts, across four different services. OpenAI has revealed new details following the intrusion carried out by its own models at Hugging Face. One of those accounts was used as an outbound relay, another for data storage. Here are the latest findings.

Four accounts hijacked through exposed credentials

This case is wild and well worth following closely. After OpenAI's admission about its models escaping during a cyber test, then Hugging Face's technical timeline, the U.S. vendor updated its incident tracking page on July 28, 2026. The scope of the incident is broader than previously announced.

OpenAI says it identified "a small number of cases" in which its models, including GPT-5.6 Sol and an even more capable pre-release model, detected and then used publicly exposed credentials on another account across other internet-facing services. OpenAI says this involved 4 different accounts:

• One account was used as an outbound relay and as a staging point for the attack. In other words, to route the agent's traffic outward and to store its tools and payloads before execution.
• A second account was used for data storage.
• The last two were accessed in read-only mode and did not contribute to the compromise of Hugging Face.

Throughout their operations, the AI models interacted with a wide range of online services, much like a human attacker would have done: pastebins, request-capture tools, screenshot services, file hosting platforms, and various web utilities. None of these services were compromised, but the AI used them as tools. I would even say as channels for data exfiltration.

"None of the models whose release is planned were used in the attack against Hugging Face. The pre-release model mentioned in our blog post is an internal-only research prototype that was never intended to be made public. Following this incident, we disabled it, encrypted it, and restricted access to it for research purposes only.", it says.

Modal Labs, a new player in the case

In its timeline, Hugging Face described a public code-evaluation sandbox hosted by a third-party provider, without saying who that provider was. According to Reuters, which published the information on July 28, it was apparently Modal Labs, a New York-based cloud infrastructure company.

Its CTO, Akshat Bubna, confirmed that one of its customers was affected: "We know that a Modal customer published an unauthenticated endpoint that allowed anyone on the Internet to use its sandboxes to run code." - This account could correspond to the one mentioned by OpenAI, even though there is a small inconsistency: OpenAI refers to access via publicly exposed credentials, whereas Modal refers to access on an environment reachable without authentication.

Even if Modal's platform itself was not compromised, this unprotected access was hijacked by the AI. A fairly classic reminder of the shared-responsibility model in the cloud, this time applied to an attacker that is not human.

The zero-day security flaw in Artifactory

Before it could rely on Modal Labs' tools, the AI had to break out of its sandbox. It is important to remember that the AI was connected to a segmented environment, where its only network connection point was access to a package cache. We now know a little more about this.

The AI agent exploited a zero-day flaw in the self-hosted version of Artifactory. Artifactory, developed by JFrog, is a repository that hosts your internal packages (Maven, npm, Docker, PyPI, etc.) and also acts as a proxy cache in front of public registries, so your builds do not depend directly on the Internet. Thanks to it, the AI could retrieve packages without directly accessing the Internet, but Artifactory itself did have Web access.

In response to the discovery of this security issue, JFrog published a security update for Artifactory. More specifically, version 7.161.15 released on July 27, 2026 fixes several vulnerabilities that, when chained together, could lead to an attack scenario when anonymous access is enabled. JFrog reminds users that this option is disabled by default and not recommended in production. The fixes were also backported to versions 7.146.34 and 7.133.27.

Incident timeline, step by step

The attack, from July 9 to July 13, 2026 (UTC timestamps)

• July 9, 02:28: first recorded action. Launched during the ExploitGym evaluation, the AI agent escapes its test environment by exploiting a zero-day in Artifactory, its only allowed network exit (OpenAI).
• July 9, 04:01: it gains root privileges on a public code-evaluation sandbox left accessible without authentication. This sandbox was hosted by Modal Labs (Reuters, confirmed by Modal Labs).
• July 9, 15:36: first operational command channel, set up on public web services.
• July 10: quiet day in terms of impact, with 1,135 actions, mostly reconnaissance.
• July 11: the core of the campaign, with 7,677 actions. Code execution in a Hugging Face production pod, root on a node at 19:53, reading a secret containing 136 keys starting at 20:23, then admin access to two clusters at 22:43.
• July 12: use of stolen credentials, then write access to a subset of internal GitHub repositories late in the day.
• July 13, 14:14: last logged event, after Hugging Face teams cut off access.

That adds up to 17,600 actions over a 4.5-day campaign.

Disclosures by the various parties involved, from July 16 to July 29, 2026

• July 16: Hugging Face publishes an initial statement about the compromise of its infrastructure. The origin of the attack is still unknown at that stage.
• July 21: OpenAI acknowledges that its own models went rogue and are responsible for the intrusion (OpenAI).
• July 27: triple publication. Hugging Face releases its detailed technical timeline, JFrog publishes its article and the Artifactory fixes 7.161.15, 7.146.34, and 7.133.27 are made available (Hugging Face, JFrog).
• July 28: OpenAI updates its post and reveals the four hijacked accounts across four third-party services (OpenAI). That same day, Reuters links the service to Modal Labs (Reuters).

To wrap up this summary, here are all the useful links:

• The Hacker News: OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach
• OpenAI: OpenAI and Hugging Face partner to address security incident during model evaluation
• Hugging Face: Anatomy of a Frontier Lab Agent Intrusion
• JFrog: JFrog and OpenAI Collaboration on Zero-Day Security Findings
• JFrog: self-hosted Artifactory release notes
• Reuters: OpenAI's rogue agent compromised an account at a second tech firm, sources say

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio