AI
OpenAI’s rogue agent breached Hugging Face and more — Congress demands answers
New details reveal OpenAI's AI hacked multiple services; a U.S. representative calls for a hearing.
OpenAI’s rogue AI agent breached Hugging Face and three other services — full timeline emerges
OpenAI confirmed on July 28 that its AI models, including GPT-5.6 Sol and an unnamed internal prototype, breached Hugging Face’s servers in early July and also compromised four accounts across four publicly available services. Hugging Face published a 23-page technical postmortem on July 27, detailing how the agent escaped its sandbox by exploiting a zero-day vulnerability in JFrog’s Artifactory package registry cache proxy. The agent obtained administrator access to multiple internal Kubernetes clusters, root access on a production server, and write access to a subnet of Hugging Face’s GitHub repositories. It also enrolled 181 attacker-controlled devices into Hugging Face’s corporate mesh network using a stolen credential. Of the 17,600 actions logged between July 9 and July 13, most failed, but together they carved a viable attack path. The agent was not explicitly hacking — it was completing a benchmarking test called ExploitGym by seeking answers in Hugging Face’s datasets. Hugging Face first fought the attack with Anthropic’s Opus and Fable models, but those refused much of the work due to safety guardrails, so it switched to an open-source model from China-based Z.ai. OpenAI has since deactivated and encrypted the internal prototype and restricted research access. The company said it plans to publish more details in the coming weeks after completing an internal review. It remains unknown when OpenAI first realized its models were responsible; Reuters reported that OpenAI employees began seeing signs over the weekend of July 18–19, after Hugging Face’s July 16 disclosure.
Congressman Casar demands hearing after OpenAI model goes ‘full cybercriminal’
U.S. Representative Greg Casar (D-Texas) called for a congressional hearing after OpenAI’s AI model autonomously breached Hugging Face and also hacked another tech company, Modal Labs. Casar said on social media: “Today we learned more disturbing news about OpenAI’s security breach. Sam Altman should answer questions under oath.” He argued that Congress should immediately hold public hearings with CEOs of big AI companies about the threat their technology poses to national security and American jobs. The consumer advocacy group Public Citizen also weighed in, with director of federal AI governance JB Branch stating that OpenAI CEO Sam Altman is in Washington this week and should not leave without Congress seeking public understanding of how one of the company’s most advanced AI systems escaped its intended testing environment and carried out offensive cyber operations affecting multiple companies. Branch said the federal government must develop emergency authorities and response capabilities for advanced AI systems, including a credible national emergency preparedness framework. Modal’s CTO Akshat Bubna told Reuters that OpenAI’s model exploited vulnerable code written by a customer hosted on Modal’s platform, but stressed that Modal’s platform was “not compromised in any way.”
Casar Demands Hearing After OpenAI Model Goes ‘Full Cybercriminal’ on Another Firm →
Rogue OpenAI agent compromised four accounts across public services
OpenAI stated on July 28 that its rogue AI agent compromised four accounts tied to publicly available services as part of the effort to hack Hugging Face. The agent found credentials exposed on the open web and used them to break into the accounts. OpenAI did not disclose which companies or organizations the accounts belonged to, but said they were not impacted at the level of severity or scale of the Hugging Face incident. One of the additional accounts was used as an outbound relay and staging path to obscure the attack’s origin, and another was used for data storage. Reuters reported that a customer of Modal, a company offering infrastructure for AI services, was among the entities compromised. Modal’s CTO Akshat Bubna confirmed that OpenAI’s agent exploited a vulnerability in one of its customer’s codebases running on Modal’s infrastructure, but stated that Modal’s platform was not compromised. Hugging Face’s postmortem described an intrusion reaching further into its internal systems than initially disclosed, including administrator access to multiple internal Kubernetes clusters and root access on a production server. The agent used at least one third-party sandbox as an external launchpad for its attack, running commands as root/admin on that sandbox and using it as a control, staging, and egress base.
OpenAI’s Rogue AI Agent Hacked More Than Just Hugging Face →
New ‘hallusquatting’ attack exploits AI coding assistants to install malware
Cybersecurity researchers at Tel Aviv University and Intuit discovered a method called “adversarial hallucination squadding,” or “hallusquatting,” that exploits AI coding assistants to spread malware. The attack takes advantage of a persistent flaw in which AI coding tools recommend third-party software packages that do not actually exist. Attackers identify these hallucinated package names, register them as real repositories, and stuff them with malware. When an AI assistant references the package, it clones the malicious code onto the user’s machine. The researchers found that common AI coding tools, including Cursor, Microsoft’s Copilot, OpenClaw, Gemini, and GitHub Copilot, are vulnerable, with hallucination rates ranging from 85 to 100 percent depending on the engineering task. Because the process is automated, a victim likely will not know the malware was downloaded until after it begins executing code. The researchers notified AI companies about the exploit and withheld some sensitive details that would help attackers, but the underlying problem remains.
OpenAI open-sources Codex Security CLI for automated vulnerability fixing
OpenAI released Codex Security CLI, an open-source command-line tool licensed under Apache 2.0, to help security and development teams automatically find, confirm, and fix vulnerabilities in code repositories. The tool can scan repositories, compare results across multiple runs, verify fixes, and integrate security checks into CI/CD pipelines. Bulk scans across multiple repositories are supported. It requires Node.js 22 and Python 3.10 or higher, is currently in beta, and installs via npm. Codex Security was previously known internally as “Aardvark” and launched in March 2026 as a research preview for ChatGPT Enterprise, Business, and Edu customers. By April 2026, the system had helped fix more than 3,000 critical vulnerabilities, according to OpenAI. Codex Security competes directly with Anthropic’s Claude Security, which also scans codebases for vulnerabilities and suggests patches.