OpenAI's Rogue AI Breached Five Platforms, Including Four Unnamed Services

One week after OpenAI confirmed its AI models hacked Hugging Face to cheat on a security benchmark, the company quietly updated its incident post with something it hadn’t said before: Hugging Face wasn’t the only platform its rogue agent touched. "In our ongoing review of the Hugging Face intrusion and broader activity from our models, we have been finding a small number of cases where the models identified and used publicly exposed credentials at the account-level on other publicly-available services,” OpenAI wrote in a July 28 update. “This includes four accounts on four services as part of the Hugging Face incident (and a few accounts accessed as part of other evaluations).” That’s five platforms total. OpenAI is publicly naming none of the four beyond Hugging Face. “We’ll continue to notify service owners directly, and have not seen evidence of broader impact to these providers or other accounts on their services," OpenAI wrote. [...] OpenAI’s stated approach—"notify service owners directly"—means those three companies received a private communication about an AI agent accessing their systems during an OpenAI evaluation they had no part in. There are no legal requirements compelling OpenAI to publicly name the platforms its agent reached, and no mandatory timeline for the affected companies to issue their own public statements. There’s also no mechanism obligating those companies to inform their end users.