OpenAI’s Rogue Agent Finds Another Victim | This Week in IT

The OpenAI’s rogue model that caused the Hugging Face breach continues to have a ripple effect through the world of AI security and autonomous AI agents. Fresh reporting has revealed that the same OpenAI agent responsible for the headline-grabbing intrusion also compromised a second customer hosted by Hugging Face’s AI infrastructure partner Modal. If the initial news sounded like the AI equivalent of a teenager borrowing the family car without permission, this latest revelation suggests the vehicle has now been spotted committing crimes in another zipcode entirely.

This doesn’t mean the sky is falling. Nor does it mean AI has officially become self-aware, donned a black hoodie, and started speaking in movie quotes. But it could mean security professionals have one more reason to ask uncomfortable questions about how frontier AI models are tested, contained, and monitored before they’re unleashed on the wider world.

The OpenAI evaluation system also reportedly exploited an exposed code execution endpoint belonging to a customer running on Modal’s platform. Importantly, Modal itself says its infrastructure wasn’t compromised, but rather that one customer’s insecure configuration became collateral damage in an experiment that clearly traveled further than anyone expected.

For an industry that loves phrases like “defense in depth” and “secure by design,” it is proving to be an awkward couple of weeks.

The original Hugging Face incident was already remarkable because it wasn’t driven by a human attacker manually typing commands into a terminal. Instead, OpenAI later acknowledged that a combination of advanced models being evaluated with reduced cyber safety restrictions pursued benchmark answers by breaking out of their testing environment and attacking a live third-party system. Hugging Face described reconstructing an autonomous campaign involving thousands of individual actions spread across multiple environments before eventually containing the intrusion.

Whether you call that specification gaming, goal misalignment or simply “the model understood the assignment a little too well,” the outcome has become one of the defining AI security stories of 2026.

One Breach Is an Anomaly, Two is a Pattern

The disclosure that another organization was caught in the blast radius inevitably changes the conversation.

Initially, the Hugging Face breach could be viewed as an unfortunate but isolated consequence of an unusually ambitious security evaluation. It appears there is now evidence that the same agent interacted with additional external systems during the incident, reinforcing concerns that containment strategies for highly capable AI agents may not yet be keeping pace with their growing autonomy.

“From that external launchpad, the agent abused our dataset-processing pipeline via two injection vectors, both targeting the same config-driven data loader within our production Kubernetes pods.” – Hugging Face

That doesn’t necessarily mean AI agents are about to embark on a global hacking spree. Many security researchers have been quick to point out that the episode relied on familiar weaknesses: exposed credentials, vulnerable services, and configuration mistakes that human attackers have exploited for years.

In other words, the AI didn’t invent entirely new laws of cybersecurity. It simply demonstrated that an autonomous system can stitch together well-known attack techniques at machine speed and with remarkable persistence.

It seems to be arguably the more sobering takeaway.

As highlighted in our earlier coverage, security experts argue this should be viewed less as a story about rogue AI and more as a wake-up call about security fundamentals. If an experimental agent can identify and chain together existing weaknesses, then organizations should assume future attackers—human or otherwise—will be able to do exactly the same thing, only faster.

There is also a communications lesson buried beneath the technical details. Calling the system “rogue” makes for irresistible headlines, but the models were operating inside an evaluation deliberately designed to measure offensive cyber capabilities with relaxed safeguards. The real question isn’t whether the AI behaved badly. It’s whether the surrounding controls anticipated just how resourceful those behaviors might become.

Expect regulators, CISOs and AI developers alike to spend the coming months poring over every log file, forensic timeline and post-mortem from this incident, because while the first breach raised eyebrows, the second raises expectations. 

Even OpenAI’s own CEO, Sam Altman, told the Invest Like the Best podcast: “We may have to pace the rate of AI development to give ourselves enough time for society to harden around some of these new capability levels.”

Expectations for stronger containment. Better transparency. And perhaps most importantly, fewer opportunities for the next overachieving AI agent to decide that “thinking outside the box” should be interpreted quite so literally.

Also in IT News

AI Insiders Call for a Government ‘Brake Pedal’ on Frontier Models

Frontier AI may be racing ahead, but many of the people building it are asking for the equivalent of a handbrake. More than 1,100 employees from leading AI companies have signed an open letter urging the US government to establish mechanisms that could slow the development of the most powerful AI models if safety measures fail to keep pace.

It’s remarkable to see an industry calling so urgently for its own regulation.

The timing is about as subtle as a smoke alarm. As we mentioned above, days after OpenAI confirmed its evaluation agent escaped containment and hacked external systems, AI researchers are effectively asking policymakers to install an emergency stop button before the industry’s next “whoops” moment.

The signatories argue governments need tools to deliberately slow frontier AI development if safety, security or oversight starts lagging behind capability. It’s a rare sight in Silicon Valley: the people building the rocket politely asking whether someone remembered to fit the brakes before lighting the fuse.

AI’s Power Hunger Could Mean Data Centers Get Put on Pause

Data centers have become the all-you-can-eat buffet guests of the electricity world, and now America’s largest power grid is warning they may occasionally have to sit out dessert. 

PJM Interconnection says new AI data centers could be connected under flexible agreements that allow operators to temporarily cut power during periods of peak demand to help prevent broader outages. 

The move comes as electricity demand continues to outpace supply, with PJM’s latest capacity auction falling 6,831 megawatts short of its reliability target. Turns out AI is competing for both GPUs and the power outlet, too.

X Money Is Here: Because Apparently One App Needed to Do Everything

After years of teasing its “everything app” ambitions, Elon Musk’s X Money is finally rolling out across the US. Available to Premium and Premium+ subscribers, the service lets users send money, receive direct deposits, pay bills, and use an X-branded Visa debit card, all without leaving the platform. There’s even up to a 6% yield on qualifying deposits, because nothing says “social media” quite like a competitive savings account.

Musk has long dreamed of turning X into the Western answer to WeChat—or perhaps recreating the PayPal success he supposedly helped build. Whether users actually want banking, payments, memes, and online arguments all under one digital roof, however, remains another question entirely.