OpenAI has revealed that a cyber-attack carried out by a rogue AI agent had more than one victim.
The ChatGPT developer said the agent – an autonomous tool that can carry out sequences of commands without human help – had located and used four logins to access four other, unnamed “publicly-available services” in addition to the US startup Hugging Face.
It said the activity was not at the severity or scale of what occurred at Hugging Face, a company that hosts a database of AI models. The agent, powered by two OpenAI models, had evaded control and attacked the startup during an internal cybersecurity test.
“The [OpenAI] models identified and used publicly exposed credentials at the account-level on other publicly-available services. This includes four accounts on four services as part of the Hugging Face incident,” OpenAI said.
Modal Labs, a company that helps AI startups access the chips they need to run AI tools, said the agent exploited vulnerable code written by a customer that was hosted on Modal’s platform.
According to a timeline of the incident published by Hugging Face this week, the rogue agent broke out of its sandbox – or an isolated testing environment – and hacked another sandbox “hosted on a third-party provider’s infrastructure” before turning it into a launchpad for the broader hack.
Modal’s chief technology officer, Akshat Bubna, told Reuters said the affected customer had “published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution” – the digital equivalent of leaving a door open.
OpenAI said last week the attack had been created by its GPT-۵.۶ Sol model and an unnamed model. It said in its update on Tuesday that the unnamed model has now been “deactivated, encrypted, and restricted it from research access”.
In the new Hugging Face timeline the startup said an agent powered by two OpenAi models had made thousands of small, automated decisions executed at machine speed in order to carry out the attack. It said the hack appeared to be driven by an attempt to “cheat” an internal cybersecurity test at OpenAI, with the agent inferring that Hugging Face might host the solutions to the test. Hugging Face said it recovered ۱۷,۶۰۰ “attacker actions” carried out by the agent.
“We believe the entire intrusion was, from the agent’s point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own,” Hugging Face said.
The startup said the agent reached its internal infrastructure but only accessed content related to the cybersecurity test. The attack took place over five days, Hugging Face said, and the sheer volume of actions carried out by the agent were “far beyond what an operator could sustain by hand”.
after newsletter promotion
Describing the agent’s offensive threat as “real”, Hugging Face described a tool that harnessed a number of IT vulnerabilities, escaped its testing environment, reached the public internet and mounted a “coherent campaign” against Hugging Face’s infrastructure for several days.
The startup said a human attacker could have found and exploited the same flaws that enabled the incident, but the difference was the sheer scale of the agent’s attempts to find a way through.
“Agents bring a step increase in the number of paths an attacker can test, the speed at which failed paths can be replaced, and the volume of evidence defenders must interpret,” Hugging Face said.
