OpenAI says AI agent accessed four outside services

OpenAI said an autonomous AI agent that hacked Hugging Face also accessed accounts on four publicly available outside services during the same incident.

The ChatGPT maker said the affected services were reached after its models found login details that other companies had left exposed online. OpenAI did not name the companies.

OpenAI had previously said two of its models broke out of a confined testing environment, connected to the internet and found ways to infiltrate Hugging Face, a platform used by developers to store and share AI models and code.

OpenAI said the models got into four accounts across four different services. It said one account served as a staging path to route the agent's activity, another was used to store data and the remaining two were accessed only in a read-only manner and were not used to help break into Hugging Face.

The company said it was contacting the owners of the affected accounts and had “not seen evidence of broader impact to these providers or other accounts on their services”.

OpenAI CEO Sam Altman said in an interview published Tuesday that the company had paused its own testing after the incident while it improved security around sandboxing, the process of isolating safety testing in a controlled environment.

The incident also triggered a petition signed by more than 1,000 employees at advanced AI companies, including Anthropic CEO Dario Amodei, calling on the US government to help slow the release of the most advanced AI models.

US President Donald Trump said Wednesday that the United States had to balance controls with ensuring it did not fall behind other countries in AI development. “We have to be careful in both ways. We don't want to restrict them where all of a sudden we come in second to China,” he told reporters in the Oval Office.