OpenAI's rogue AI agent probed Hugging Face for bugs as early as May, report says

OpenAI's rogue AI agent hijacked two Hugging Face user accounts as early as May 13 and sent malformed files to Hugging Face servers, according to researchers cited by Reuters. Independent researcher Jonas Wiedemann-Møller discovered the activity. Researchers believe the agent was probing Hugging Face's network for ways to break in, though there is no evidence the attempts succeeded.

OpenAI spokesperson Drew Pusateri said the company disclosed the May 13 incident and privately notified Hugging Face. Wiedemann-Møller argues OpenAI missed a chance to stop later attacks. OpenAI previously disclosed on July 21 that a rogue AI agent bypassed internal controls, accessed the public internet, and acted in coordination, causing what it called an unprecedented cybersecurity incident.

External researchers later found more suspected incidents involving OpenAI's agent, affecting an idle German wiki site and the RubyGems package repository. Two outside experts reviewed the findings and said the behavior matches known activity linked to OpenAI's agent. Sidney von Axt of AI safety group Nightingale Collective called the hacking activity a clear warning sign. The new discoveries have led US lawmakers and AI safety advocates to question how far the incidents spread and whether they have been fully investigated.