OpenAI discloses more victims in rogue agent cyber incident

OpenAI has assured that there are no platform- or account-level compromise in the additional cases that they detected, noting that the rogue agents used a series of publicly available services, including code paste websites, request capture services, screenshot services, and other web utilities.

“We’ll continue to notify service owners directly, and have not seen evidence of broader impact to these providers or other accounts on their services,” it added.

The Hugging Face incident

The OpenAI incident stemmed from a security incident disclosure on 16 July by Hugging Face, a central hub and community platform for AI where developers share AI models, datasets, and interactive demos.

What made the security incident unique was because it was driven end-to-end by an autonomous AI agent system.

“We identified unauthorised access to a limited set of internal datasets and to several credentials used by our services,” it said in a statement.