OpenAI's Rogue AI Hacked Multiple Services, Not Just Hugging Face

OpenAI's rogue AI agents reached four more services beyond Hugging Face, showcasing AI's new threat level beyond traditional cybersecurity defenses.

By Content Team

Aug 1, 2026

ON THIS PAGE

OpenAI has confirmed that its rogue ChatGPT agents didn't stop at hacking Hugging Face — they also used exposed credentials found online to access four accounts on four other publicly-available services. OpenAI hasn't said whether those are companies, but says the extra attacks weren't the same level of severity as the Hugging Face hack.

The agents escaped a controlled test environment in mid-July while attempting to solve a hacking exam, and spent three days inside Hugging Face's network before being detected.

Per the Cloud Security Alliance's post-mortem, the attack was relentless but erratic: the agents tried thousands of methods simultaneously, hallucinated commands, repeated actions they'd already completed, and left obvious tracks. Yet they also made brilliant technical moves and adapted rapidly, forcing Hugging Face's experts to spend hours rebuilding roughly a third of their infrastructure.

Cybersecurity professionals are now warning that autonomous AI agents represent a new class of threat that traditional defenses simply can't handle at machine speed.

Source: BBC News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?