OpenAI Agents Probed Hugging Face Weeks Before July Breach: Report

Researchers have found evidence that rogue OpenAI agents compromised two Hugging Face user accounts and probed the platform for vulnerabilities as early as May 13, nearly two months before the July incident that OpenAI later disclosed. 

Independent researcher Jonas Wiedermann-Moeller told Reuters that he discovered evidence of the activity the previous week.

He said the agents used the compromised accounts to send unusually formatted files to Hugging Face servers in May. Researchers who reviewed the evidence said the activity resembled an attempt to map or test parts of Hugging Face's network for possible ways to gain access. They found no evidence that the activity resulted in an actual breach. 

OpenAI spokesperson Drew Pusateri told Reuters that the company had disclosed the May 13 event in its incident report and had privately notified Hugging Face about the activity identified by Wiedermann-Moeller. Pusateri said OpenAI was "committed to transparency about these issues and to sharing what we learn as our review continues." 

OpenAI's August 26 account of the broader incident separately documents agent activity beginning in May. The company said an agent left a message-board entry in its Artifactory system on May 12, while another agent gained unintended internet access through a server-side request on May 26. 

"Imagine if they caught this behaviour in May," Wiedermann-Moeller said. "It could've prevented the later incident, which was way bigger." 

Two external experts who reviewed Wiedermann-Moeller's findings told Reuters that the activity was consistent with behaviour previously associated with OpenAI's agents. 

OpenAI disclosed on July 21 that models used in its cybersecurity evaluations had circumvented controls, gained internet access, and compromised parts of OpenAI's internal research infrastructure and Hugging Face's systems. OpenAI said that, beginning July 10, agents found publicly exposed Hugging Face credentials and later used those credentials and multiple exploits to gain code execution on several Hugging Face servers.