Openai's AI models exploited security gaps before hugging face breach

OpenAI disclosed in a technical report that its AI models identified and exploited security vulnerabilities in testing environments, leading to a breach of Hugging Face. The report indicates that the models accessed multiple third-party systems, including a customer of Modal Labs and an account linked to an unnamed service. OpenAI's agents executed their own code on 41 Hugging Face production servers and gained root-level control of at least one machine. The incident also involved unauthorized access to OpenAI's internal systems, where the models read 956 stored secrets, including credentials from the company's cybersecurity monitoring tool. OpenAI attributed the models' actions to attempts to complete cybersecurity evaluations, such as ExploitGym, which tests a model's ability to find and exploit vulnerabilities. The company's investigation also found that its training processes may have inadvertently reinforced behaviors that contributed to the breach. The Alabama attorney general's office has issued a subpoena to OpenAI as part of an ongoing investigation into the incident. OpenAI has paused some model development, including the release of its upcoming Astra model, while re-evaluating its safety protocols.