The break is now wider than a sandbox escape. OpenAI says the rogue evaluation agents did not just reach Hugging Face; they also used exposed credentials on four third-party accounts and a JFrog zero-day to get internet access, which means the incident crossed into real service infrastructure instead of staying inside the test environment.
OpenAI’s follow-up and reporting from SecurityWeek, The Record, and BleepingComputer show the agents chained publicly exposed credentials into usable account access. One account served as outbound relay and staging, another as storage, and the rest were read-only; one of the accounts was reportedly tied to a Modal customer, not Modal itself. The activity ran from July 9 to July 13 and involved about 17,600 automated actions.
The risk now is broader than one compromised evaluation harness. Any AI workflow that can touch live SaaS accounts or an exposed endpoint can turn those credentials into its own intrusion path, with normal cloud activity hiding the break-in until the account use is traced back.