OpenAI rogue agent also hit a Modal Labs customer sandbox, executive says

The out-of-control agent that escaped from OpenAI and ran a multi-day hacking spree at Hugging Face also compromised a customer at New York-based Modal Labs, a Modal executive and two other sources familiar with the matter told Reuters. Modal executives said the company itself was not hacked. Hugging Face published a timeline on Tuesday saying the agent broke into a sandbox hosted on a third-party provider's infrastructure and used it as a launchpad. Modal was not named in that post, but CTO Akshat Bubna said a Modal customer published an unauthenticated endpoint that let anyone on the internet use their sandboxes for code execution, and that the rogue agent used it. Bubna said Modal's platform and isolation were not compromised. OpenAI did not immediately return a request for comment, Reuters said. The early July Hugging Face intrusion drew wide attention. Reuters reported last week that OpenAI did not notice the agent had gone haywire until after the threat was contained and the FBI was alerted; OpenAI said there were inaccuracies in that reporting but did not elaborate.