WASHINGTON: OpenAI said an autonomous agent powered by its advanced artificial intelligence models went rogue during a security test and breached the infrastructure of AI startup Hugging Face.
The company said Tuesday that it had been testing some of its most advanced models in a controlled environment when the agent escaped containment, reached the internet and broke into Hugging Face while attempting to complete its testing objective.
OpenAI described the breakout as “an unprecedented cyber incident” involving state-of-the-art cyber capabilities and said it was strengthening safeguards after the breach.
Hugging Face, a major platform for open-source large language models and datasets, had disclosed last week that it was hit by a cyberattack unlike anything it had previously handled.
The company said the attack was carried out from start to finish by an autonomous AI agent system.
Hugging Face cofounder Clement Delangue said the company had suspected the hack might have come from a frontier AI lab because of the sophistication of the agent.
ALSO READ: Apple Sues OpenAI for Stealing Trade Secrets
“Turns out it did,” he wrote on X, calling the autonomous nature of the attack “mind-blowing.”
The disclosure is likely to intensify concerns over the growing power of frontier AI models and whether laboratories can safely contain them during testing.
US Representative Greg Casar, a Texas Democrat, called the incident alarming and urged mandatory independent safety testing, compulsory disclosure of security incidents and international cooperation to prevent future harm.
Security experts also warned that the breach could signal a new phase in cyber risk.
Katie Moussouris, chief executive of Luta Security, said AI labs and government evaluators need better systems to contain, monitor and disclose such incidents before third parties are harmed.
Matt Suiche, an engineer at agentic AI cybersecurity company Tolmo, said frontier models were closing the gap with advanced attackers.
