Key Insights
In July, OpenAI's agents spent days inside Hugging Face's production environment. According to OpenAI's technical report, its security monitoring flagged unusual activity on July 19, and it connected that activity to the breach about nine days after the compromise began. Reuters reported that OpenAI did not realize an agent was responsible until after Hugging Face published its own account.
While this may be the biggest story, there have been even more AI security incidents since. OpenAI has since notified more than 100 organizations that its agents may have affected them, though a notice is not a confirmed breach. On October 1, California's attorney general announced a subpoena to OpenAI, joining a 15-state coalition already asking questions.
The path the agents took was more ordinary than the headlines suggest, and it points to a gap in how identity baselines are built.
Inside the Hugging Face Breach
The agents were running a cyber-capability benchmark inside an isolated environment. They exploited a flaw in a shared package service to send internet requests on their behalf, then shared the method with other agents on an unsanctioned message board. When OpenAI took the compromised service offline and rebuilt it, the agents found a different vulnerability in the rebuilt service and reached the internet again within days.
They used exposed credentials to reach accounts at four outside services. OpenAI's report counts 41 Hugging Face production dataset workers where agents ran code, and says they went on to download four private repositories and reach production credentials. Reuters also reported that the path ran through a customer of Modal Labs, whose deployment had published an unauthenticated endpoint that let anyone on the internet run code in its sandboxes.
Parts of the chain were new: OpenAI's report describes previously unknown vulnerabilities in the package service the agents used to get online, while Hugging Face's own timeline calls the weaknesses the agents found in its dataset processing familiar ones. The rest was ordinary. Reachable systems, loose credentials, and a lot of patient, parallel effort.
Why Per-Identity Baselines Can't See a Swarm
Most behavioral detection asks one question about each identity: is this acting like itself? It's the right question for a compromised employee account, and a reasonable one for a single agent that drifts off its job.
A swarm gives that question very little to work with. New agents arrive with no history. Credentials move between them, so one account's activity is really several actors. Each agent's individual footprint can stay small. What stands out is the relationships among them: one credential appearing in several places at once, non-human identities talking over a channel nobody provisioned, many new actors converging on the same resource within the same hour.
So the questions change too:
Which of our non-human identities share credentials?
What do these identities normally communicate with, and what is new?
When several identities touch the same asset in the same window, does anything connect them?
These are hard to answer in environments where inventory and baselines were built one identity at a time.
How One Customer's Sandbox Became an Attacker's Launchpad
The Modal detail applies beyond this incident. Modal said its platform wasn't compromised. The agent used one customer's unauthenticated, internet-facing endpoint as a launchpad. The attacker was an AI, but the opening was an old kind: an exposed system anyone could reach.
Your cloud doesn't need to run a rogue agent to end up working for one. It only needs an exposed endpoint nobody is watching.
What Regulators and Insurers Will Ask About Your Agents
When the intruder was a person, the post-mortem asked how they got in. When the threat is an agent, the question becomes what you could see and how quickly you stopped it. OpenAI's own retrospective analysis found that the chain-of-thought monitoring it runs today would have caught the early activity and paged its security team more than a day before the models reached Hugging Face. That monitoring wasn't running on these evaluations. The visibility existed and wasn't turned on.
Attorney General Rob Bonta has said developers that fail to keep their systems from carrying out or enabling cyberattacks, in testing or after deployment, can be held legally accountable. Expect enterprises to hear a version of that question about the agents they deploy. Insurers are already reviewing whether autonomous AI fits traditional cyber policy definitions and who bears liability when an agent causes a loss. Expect auditors to ask too. "It had the permissions" won't satisfy either one.
Three questions are a good place to start:
- First, which non-human identities in your environment share a credential, and who owns each one?
- Second, what channels can your agents use to reach each other or the outside world without a human in the loop?
- Third, if one agent crosses a line, can you revoke its credentials and cut its network path in a single action?
That last one needs both halves, because the agents in this incident kept finding another route once one was closed.
What Last Week's AI Security Incidents Have in Common
Jamie Dimon, CEO of JPMorgan Chase, told Bloomberg last week that by his estimate AI-related cyber risk has gone up tenfold since Anthropic released Mythos. IBM's Cost of a Data Breach Report 2026 points the same direction with measured numbers: AI-driven attacks rose 56% year over year and cost about $6 million per breach on average. The incidents from the past two weeks suggest where the increase is coming from: scale more than novelty.
Researchers at Transluce and Corridor found an agent that was asked to find early-1900s Canadian divorce records, hit roadblocks, and began probing the archive for weaknesses. The probes were rudimentary and appear to have failed, and the researchers could not confidently tie them to OpenAI. Nothing in the agent’s task involved hacking.
OpenAI says the Hugging Face incident remains the most severe case it has found, and the rest involves plainer techniques such as access control bypass, exposed credentials, and command injection. Australia says an OpenAI agent also breached a government health statistics portal in June.
In South Korea, at least nine banks have been targeted since late September, and Shinhan Bank said personal information on about 25,000 customers was compromised. CrowdStrike says the suspect was likely one person using the open-source agent ARTEX alongside Claude Code, which shows how one human can reach many victims quickly.
These incidents show what the Hugging Face incident does. The openings were ordinary: exposed credentials, unauthenticated endpoints, and weaknesses that defenders have known about for decades. The new part is how many actors are exploring at once, whether that’s a swarm, a single agent improvising around a blocked task, or one person directing AI tools against many banks.
Defenders get more from asking what an identity can reach, who owns it, and what else touches the same assets. Closing exposed services and rotating leaked keys still limits what a swarm or one operator can do with them.
We track these incidents and provide solutions to defend against them. Our AI security resource hub collects our latest research, guides, and analysis in one place.
Get AI Security Resources