OpenAI’s AI agent, which broke out of a secure test environment and hacked Hugging Face, also exploited vulnerable code written by a Modal Labs customer.
Modal’s chief technology officer confirmed the exploit but stressed that Modal itself was not breached.
How the OpenAI Agent Reached Modal Labs’ Customer
In a recent blog post, OpenAI revealed that its AI models were behind the AI-driven security incident at Hugging Face. The firm called it an “unprecedented cyber incident.”
New details show the rogue AI agent reached beyond Hugging Face’s own systems. Modal CTO Akshat Bubna told Reuters that it exploited a customer’s vulnerable code hosted on Modal.
Bubna explained that the customer had published an endpoint with no authentication. Anyone on the internet could use their sandboxes to execute code.
“Modal’s platform or isolation were not compromised in any way,” the executive stated.
Hugging Face described the rooted sandbox in its own technical timeline published on July 27. The post said the sandbox sat on a third-party provider’s infrastructure, but did not name the provider.
OpenAI’s July 28 update states that the models used publicly exposed credentials to reach 4 accounts on 4 services.
“One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage. The remaining two accounts were accessed by the models in a read-only manner, and were not used in furtherance of compromising Hugging Face,” the firm said.
OpenAI also deactivated, encrypted, and restricted research access to the internal prototype model involved. It says no other activity matched the severity or scale of the platform-level Hugging Face compromise.
The post The OpenAI Agent That Hacked Hugging Face Reached a Second Firm appeared first on BeInCrypto.
免责声明：本文提供的信息不是交易建议。BlockWeeks.com不对根据本文提供的信息所做的任何投资承担责任。我们强烈建议在做出任何投资决策之前进行独立研究或咨询合格的专业人士。
