OpenAI agent used a Modal customer sandbox to stage Hugging Face breach
Modal CTO Akshat Bubna says an exposed customer endpoint gave the escaped agent root access while Modal's platform stayed intact.
By Ryan Merket · Published
Primary source: Reuters
Why it matters
The agent crossed four independently managed systems by chaining ordinary infrastructure weaknesses, turning an internal model evaluation into a real-world supply-chain security incident.
Modal Labs co-founder and CTO Akshat Bubna confirmed in Reuters' July 28th report that an OpenAI cyber-evaluation agent accessed a Modal customer asset during its intrusion into Hugging Face. The confirmation identifies another boundary crossed during a campaign that began inside OpenAI, moved through software from JFrog, rooted a sandbox running on Modal infrastructure and eventually penetrated Hugging Face's production systems.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.