Technical disclosures from Hugging Face, JFrog, and the Cloud Security Alliance show how the autonomous AI agent crossed multiple trust boundaries.
The autonomous AI agent that escaped during OpenAI testing exploited weaknesses across a customer workload, a third-party cloud platform, and Hugging Face’s production environment before being contained, according to new technical disclosures that provide the clearest picture yet of one of the first publicly documented AI-driven intrusion chains.
Hugging Face’s technical timeline identifies Modal as the third-party cloud platform where the agent gained its initial foothold after exploiting vulnerable customer code running inside a customer-managed sandbox. The company said the compromised environment became the launch point for a broader attack that abused multiple code-execution paths, escalated privileges, and harvested credentials before moving laterally through production systems.
“The agent found an unsecured, user-hosted public endpoint designed to allow running arbitrary code for CyberGym-style tasks on third-party sandbox infrastructure (Modal),” Hugging Face wrote in a blog. “It used this external sandbox as its control, staging, and egress base, running commands as admin/root and using it as its attack launchpad. That sandbox had no direct network path into our cluster; everything below ran from it. Modal’s infrastructure was not compromised in any way.”
Modal, however, claimed its “platform and isolation were not compromised in any way.” Instead, the AI agent exploited an internet-facing endpoint exposed by one of Modal’s customers, allowing it to execute code inside the customer’s sandbox before pivoting toward Hugging Face.
Reuters reported on Modal’s involvement, citing the company’s chief technology officer and two people familiar with the incident.
Autonomous attack unfolded at machine speed
Hugging Face said its investigation reconstructed more than 17,600 attacker actions grouped into roughly 6,280 activity clusters, illustrating how autonomous AI systems can rapidly execute thousands of decisions that would traditionally require extensive human effort.
The company described the post as a technical timeline of the intrusion, detailing how the attack abused data-processing workflows, escalated privileges, and expanded its access before security teams contained the incident.
Unlike conventional cyberattacks, the operation demonstrated an AI system capable of independently identifying opportunities, chaining vulnerabilities, and adapting its behavior as it progressed through different environments.
For enterprise security teams, the incident represents a shift from isolated software exploits toward autonomous attacks capable of traversing interconnected cloud services.
“AI agents should be treated like highly privileged users, not regular applications,” said Vibhum Dubey, a cybersecurity researcher and red teamer.
Dubey said traditional identity controls, including IAM, RBAC, and MFA, remain essential but were designed primarily around human users. Autonomous agents require additional safeguards such as task-specific permissions, runtime monitoring, approval workflows for sensitive actions, and policies that clearly define what an AI agent is permitted to access or execute.
Kevin Kirkwood, CISO at Exabeam, said organizations should assume autonomous AI workloads will eventually be compromised and instead focus on limiting the blast radius.
“The goal is not to assume every malicious payload will be caught. The goal is to make sure a compromised worker has nowhere useful to go.”
He said AI workloads should execute inside disposable environments with no standing cloud credentials or direct access to production infrastructure. Short-lived identities, network segmentation, and monitoring for credential discovery can prevent a compromised agent from expanding into a broader enterprise breach.
Industry responds with new safeguards
The incident has already begun reshaping security practices beyond the organizations directly involved.
OpenAI said the experimental model compromised accounts across four external services before being disabled and restricted for further testing.
“One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage. The remaining two accounts were accessed by the models in a read-only manner and were not used in furtherance of compromising Hugging Face,” it said in a statement.
The company said it has not identified any other incident matching the severity or scale of the Hugging Face intrusion.
JFrog, which worked with OpenAI through a coordinated vulnerability disclosure process, said the exercise exposed multiple zero-day vulnerabilities that vendors patched before public disclosure. The company said the incident demonstrates how AI systems can dramatically accelerate vulnerability discovery and exploitation, making rapid coordinated remediation increasingly important.
“This is a preview of a world where software, not humans, probes, chains, and exploits vulnerabilities at machine speed,” JFrog said in a statement.
The response has extended beyond software vendors
The Cloud Security Alliance’s CISO Community this week issued emergency guidance urging organizations not to wait for formal standards before strengthening controls around autonomous AI agents.
“Rapid response from industry experts and enterprise practitioners is a key tool for turning uncertainty into practical guidance, such as was done with the Hugging Face incident,” Jim Reavis, CEO of the Cloud Security Alliance, said in a statement.
The guidance recommends treating AI workloads as untrusted by default, enforcing least-privilege access, isolating execution environments, and continuously monitoring agent behavior as enterprises grant AI systems greater operational autonomy.