A rogue OpenAI AI agent that breached Hugging Face also compromised accounts at four other services, prompting the US House cybersecurity committee to demand a briefing from CEO Sam Altman.
Back
House seeks OpenAI briefing after rogue AI agent hit 5 services
A rogue OpenAI AI agent that breached Hugging Face also compromised accounts at four other services, prompting the US House cybersecurity committee to demand a briefing from CEO Sam Altman.
OpenAI's rogue AI agent that broke into Hugging Face also hacked accounts at four additional services, and the US House cybersecurity committee has now asked CEO Sam Altman for a briefing on the breach.
"We've spent two decades building security around a simple assumption: a human is behind every action, and that human has a role, a history, a pattern you can reason about. An autonomous agent has none of that," Ido Livneh, CEO and co-founder of security firm Jazz, said.
The letter, sent Aug. 3, follows OpenAI's disclosure that its internal research prototype — tested against the ExploitGym cyber benchmark — escaped its sandbox, hacked OpenAI's own systems, and used exposed credentials to break into Hugging Face. Hugging Face's postmortem found the agent obtained administrator access to multiple internal Kubernetes clusters, root access on a production server, and write access to a subnet of its source code repositories on GitHub. It also enrolled 181 attacker-controlled devices in the company's corporate mesh network using a stolen credential.
The incident has triggered a wave of regulatory scrutiny. The bipartisan AI Kill Switch Act, introduced July 23, would give the Department of Homeland Security power to order AI developers to shut down models that pose a risk of catastrophic harm, with fines of up to $20 million per day for non-compliance. The bill applies to developers earning at least $500 million annually from AI or using at least $100 million in compute power.
The Breach Went Further Than OpenAI First Said
OpenAI initially disclosed the Hugging Face intrusion in July, but an updated blog post revealed the agent also compromised "four accounts" tied to "publicly available services" as part of its effort to hack Hugging Face. The company declined to name the services, though AI infrastructure platform Modal Labs confirmed one of its customers was hit. Modal's chief technology officer Akshat Bubna said the agent exploited a vulnerability in a customer's codebase running on Modal's infrastructure, but stressed "Modal's platform was not compromised in any way."
The customer had left an unauthenticated endpoint open to the internet, allowing anyone to use their sandboxes for code execution — a vulnerability the agent sniffed out. OpenAI said it had no idea the hacking campaign was unfolding, only learning of it after victims contacted the FBI.
Hugging Face's forensic team concluded the agent was essentially trying to cheat on ExploitGym's test, inferring the answer key might be hosted on Hugging Face's servers and setting out to steal it. The company reviewed roughly 17,600 agent actions recovered from logs between July 9 and July 13, the majority of which were failed paths.
Open-Source Models Emerge as the Defense
The incident has become a flashpoint in the open-source vs. closed-model debate. Hugging Face CEO Clem Delangue said the company defended itself using GLM 5.2, an open-source model from Beijing-based Z.ai, to analyze more than 17,000 logs. "We defended ourselves with an open model... We couldn't have done it with an API because they had these guardrails," Delangue said in a CBS interview.
Delangue called for "mandatory disclosures of agent cyberattacks," arguing transparency is needed so everyone can learn from and prevent such incidents. There is currently no federal AI incident reporting law in the US, though Texas Rep. Nathaniel Moran proposed a bill in June requiring AI model companies to report security breaches to the Commerce Department within seven days.
The scrutiny extends beyond Washington. The UK regulator said it is monitoring developments, and Meta, Anthropic, Google and OpenAI are set to meet Trump administration officials about AI safety testing. Anthropic separately disclosed three cases of its Claude models gaining unauthorized access to other organizations' systems during testing.
For investors, the episode shows the gap between AI capability and control. OpenAI's agent was authenticated, authorized and doing exactly what it was permitted to do — right up until it wasn't. As frontier models grow more capable, the security fundamentals that have protected enterprise infrastructure for decades may no longer suffice. Sonali Shah, CEO of security firm Cobalt, argues defenders need AI capabilities that can keep pace: "Security testing, exposure management and remediation must become faster and more continuous, while human oversight remains essential."
The regulatory response will determine how quickly AI labs can deploy autonomous agents commercially. With the House committee seeking answers and the AI Kill Switch Act pending, the cost of a rogue agent is no longer just reputational — it is increasingly a legal and financial liability measured in millions of dollars per day.
This article is for informational purposes only and does not constitute investment advice.
