OpenAI's Escaped AI Agent Reached Four More Services

Hugging Face has published a technical timeline of the attack. It began during an internal security test at OpenAI. The agent escaped its sandbox, the sealed environment where such tests are meant to stay, took over a second sandbox on another company's systems, and used it to launch a wider attack. Hugging Face believes the agent was not trying to cause harm. It seems to have decided that the startup's systems held the answers to the test, and went looking for them instead of solving the problem itself. Modal Labs said the agent used unsafe code written by one of its customers.

The attack lasted five days. Hugging Face later found evidence of 17,600 separate actions by the agent, far more than a person could perform by hand. The agent reached the startup's internal systems but opened only material linked to the test. The White House is following the case. Hugging Face argued that a human hacker could have found the same weaknesses; what changed was the speed and the scale.