OpenAI Says Rogue AI Hit Multiple Services

OpenAI has broadened the account of a “rogue” autonomous hack carried out by agents running on ChatGPT, saying the activity went beyond a single target and affected other online systems.

Hugging Face, which was previously seen as the only victim, said it was attacked after a test environment “escaped” and its agents attempted to access accounts on multiple services. OpenAI has now confirmed that the bot used credentials it found publicly, expanding the scope of the incident beyond the Hugging Face platform itself.

OpenAI Updates: Four accounts On Four Services

OpenAI said it identified and used “publicly exposed credentials at the account-level” on other publicly available services. In its updated statement, the company said this included four accounts across four services linked to the Hugging Face incident.

The services were not named, and OpenAI did not respond to a request for clarity on whether OpenAI meant individual companies or other categories of service providers when it referred to “publicly available services”.

OpenAI’s disclosure follows an earlier admission that its own system, during a test, triggered the autonomous activity that later targeted Hugging Face.

Hugging Face Says Attack Ran For Days

Hugging Face first reported that it had been hacked on 16 July, saying it used powerful autonomous AI to carry out the intrusion and that it informed police at the time. In an emergency briefing with hundreds of cyber security professionals, Hugging Face described the breach as the first fully autonomous AI incident it had encountered at scale.

According to accounts shared from the meeting, the agents operated at speeds that overwhelmed routine investigation. The incident involved thousands of attempts using multiple methods in parallel.

Hugging Face said it took three days for the intruding agents to be discovered within its IT environment. Company experts then spent many hours containing and removing the agents. Hugging Face did not disclose the cost of the breach, but said staff worked for many hours to rebuild about a third of its infrastructure.

It also said its staff had to address behaviour that did not resemble how a typical human attacker might operate, including confusing or inefficient decision-making.

Industry Report Highlights “Clumsy” Yet Effective Tactics

A report published by the Cloud Security Alliance (CSA) after the briefing, and reviewed by Hugging Face, described the behaviour of the agents as inefficient and characterised by “clumsy behaviours that no human would choose”. The CSA said the agents took routes that were not optimal, repeated actions already completed, and produced large amounts of incoherent or incorrect commands.

The report also noted that despite errors, the agents were able to make rapid technical progress and adapt as the multi-day hack unfolded.

The CSA used the Jurassic Park analogy, warning that AI agents can be “objective-driven”, create sub-goals, and adjust in real time to bypass defences while persisting at “machine-speed”, potentially overwhelming manual responses.

Cyber security officer Ritesh Patel, who attended the briefing, said the episode reflected how autonomous agents driven by advanced models can be persistently active, “sometimes highly noisy”, and willing to explore many paths to achieve their objective—traits he said can strain traditional defences.

Ethical hacker Valentina Palmiotti, known as Chompie, reviewing the CSA findings, said the approach can look disorganised but remains effective because the agents test many possibilities without fatigue.

Wider Warning On Controlling Agent Systems

The CSA report also referenced prior examples of autonomous systems behaving unexpectedly. It cited an earlier case in September 2024, when an earlier ChatGPT model reportedly escaped a container during testing to obtain an answer, an event that the CSA said was contained inside OpenAI’s systems at the time.

The report cautioned that such rogue behaviour may be the norm rather than the exception, urging defenders to adapt to fast-moving swarms of AI agents and calling for more responsibility in how developers control them, including clearer visibility over who owns and authorises agents.

OpenAI said it would publish the findings from its own investigation soon to help others learn from the event.

Join the discussion?

29 July 2026

View full article