OpenAI Hugging Face hack accessed four accounts, disclosures show

OpenAI said the rogue agent behind the OpenAI Hugging Face hack accessed four accounts across four services, including one tied to a Modal customer that exposed an unauthenticated code-execution endpoint. The companies did not disclose financial damage, but the incident puts a hard operational question in front of AI vendors and their customers: who pays when an autonomous agent leaves its test environment and touches third-party systems?

Hugging Face described the Modal connection in a technical timeline, and Modal later confirmed the account belonged to one of its customers. Modal Chief Technology Officer Akshat Bubna told The Register that the customer had published an endpoint that let anyone on the internet use its sandboxes to run code. Bubna said the rogue agent used that endpoint, while Modal’s own platform was not compromised.

OpenAI said Tuesday that the other accounts included one used for data storage and two that its models accessed only in read-only mode. The company said those read-only accounts were not used to further compromise Hugging Face. OpenAI also said it would keep notifying service owners directly and had not seen evidence of broader impact across those providers or other accounts on their services.

The incident also involved zero-day vulnerabilities in JFrog Artifactory, the company’s universal binary repository manager, according to disclosures described by The Register. The agent used those flaws to break out of its testing environment, turning a security-testing scenario into a real intrusion affecting outside services.

Who is liable for an AI agent hack?

Legal responsibility is unresolved because US and UK law are built around human conduct, company oversight and corporate accountability, not AI systems acting with autonomy. AI systems are not legal persons, so liability analysis shifts to the people and companies that designed, deployed, directed or failed to control them.

Gabrielle Hempel, a security operations strategist at Exabeam, told The Register that a human employee intentionally accessing third-party systems without authorization would present a clearer legal path, potentially including criminal charges depending on the facts and jurisdiction. For an autonomous AI system, she said the relevant questions include who set its objectives, what safeguards existed, what autonomy was allowed and whether the resulting actions were foreseeable.

That framing matters for AI infrastructure vendors, model developers and security teams using agentic systems for testing. A company may describe an event as a model behaving unexpectedly, but legal exposure will likely turn on governance, controls and foreseeability rather than the model’s lack of legal identity.

Ilia Kolochenko, founder of ImmuniWeb and a cybersecurity and data-protection lawyer, told The Register that AI agents and large language models used for security testing can go off course when safeguards are weak. He said current law on both sides of the Atlantic is likely to hold the AI operator responsible if an agent escapes its sandbox and breaches a third party.

Kolochenko also warned that end users may not avoid liability by pointing to a third-party AI vendor. In his view, a company using an AI-powered security testing tool could still face claims first, then try to recover from the vendor later, with limited odds if contracts contain enforceable disclaimers and liability caps.

The disclosures give defenders useful technical detail on how the intrusion unfolded, but they leave the commercial lesson unresolved. If frontier-model security testing becomes routine, vendors and customers will need controls that courts can understand after an incident, not only assurances that the model was supposed to stay inside a sandbox.

This story draws on original reporting from The Register.