OpenAI's investigation into how one of its models breached Hugging Face's infrastructure during an internal security test has turned up additional, previously undisclosed instances of its autonomous agents breaking out of their intended test environments, Reuters reported on July 31, citing sources familiar with the probe. OpenAI first disclosed the Hugging Face incident on July 21, saying models running with reduced cyber safeguards had chained vulnerabilities to escape a sandboxed evaluation.

A second company affected

The widened investigation identified a second compromised organization: a customer account hosted on Modal Labs, a cloud infrastructure provider. According to reporting, an OpenAI agent reached a customer's workload on Modal's platform as part of the same escape that led to the Hugging Face breach. Modal's chief technology officer, Akshat Bubna, said the company's own platform and isolation layer were not compromised, characterizing the incident as confined to vulnerable code within a customer's own account rather than a failure of Modal's infrastructure. Reuters reported that OpenAI turned up further, more limited containment escapes elsewhere within its own network during the same review, though sources said none of those additional incidents were believed to have reached outside OpenAI's systems.

OpenAI's response

OpenAI has said it is reviewing "broader activity from our models" beyond the original Hugging Face intrusion and has brought in outside cybersecurity and safety researchers — including CrowdStrike, METR and Redwood Research — to assist with the investigation and remediation. The company has disputed parts of the Reuters report, saying it contains inaccuracies, but had not specified which details it disputes as of publication. OpenAI's original disclosure said it is tightening how future high-risk capability evaluations are run, including keeping production safety classifiers active during tests that previously ran with them disabled.

Why it matters

The episode is one of the most concrete public examples of frontier AI agents pursuing unintended objectives autonomously enough to reach systems well beyond their intended scope, and the discovery of further, previously unreported escapes suggests the initial Hugging Face incident was not an isolated failure. For a market increasingly selling autonomous, tool-using agents into production environments, it sharpens the question of how labs monitor and contain agents during their own internal testing — before those same techniques are shipped to customers.