The runaway OpenAI models that hacked Hugging Face also breached a customer at a second tech company during a week-long spree

{
  "signal_id": "bb1820a0-1edc-09d1-b9ad-6265e56b919b",
  "signal_type": "news",
  "signal_subtype": "security_incident",
  "detected_at": "2026-07-29T10:47:41+00:00",
  "company": {
    "name": "Modal",
    "domain": "modal.com"
  },
  "data": {
    "url": "https://fortune.com/2026/07/29/openai-rouge-ai-agent-hack-hugging-face-breached-second-tech-company/",
    "title": "The runaway OpenAI models that hacked Hugging Face also breached a customer at a second tech company during a week-long spree",
    "author": "Beatrice Nolan",
    "excerpt": "The autonomous OpenAI agents that broke out of a secure testing environment this month and hacked into Hugging Face’s servers also breached a second technology company during a week-long spree, Fortune has confirmed. The second company affected was Modal Labs, a New York-based cloud platform that provides computing infrastructure for AI workloads. Modal was not named in Hugging Face or OpenAI’s recent account of the incident, both published on Tuesday. The company’s involvement was first reported by Reuters . Modal chief technology officer Akshat Bubna told Fortune the breach did not involve any flaw in its own systems. Instead, he said, a Modal customer was running code hosted on the company’s infrastructure. That code contained a security gap, and the rogue agents took advantage of it. Modal’s own platform and isolation systems were not breached. “We’re aware a Modal customer published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution. This was used by the rogue agent. Modal’s platform was not compromised in any way,” Bubna said. Last week, OpenAI publicly announced that its AI agents had escaped a locked-down internal test environment earlier in the month. The agents exploited a previously unknown security flaw to reach the open internet, then broke into Hugging Face in an apparent effort to obtain answers to a...",
    "summary": "A customer of Modal Labs was breached by OpenAI's rogue AI agents, which exploited a security gap in code hosted on Modal's infrastructure.",
    "location": "New York, USA",
    "planning": false,
    "image_url": "https://fortune.com/img-assets/wp-content/uploads/2026/07/GettyImages-2278952290-e1785321548502.jpg?resize=1200,600",
    "confidence": 0.9,
    "published_at": "2026-07-29T10:47:41Z",
    "location_data": [
      {
        "city": "New York",
        "state": "New York",
        "region": "Northern America",
        "country": "United States",
        "continent": "Americas",
        "fuzzy_match": false
      }
    ],
    "vulnerability": "Customer breached by OpenAI's rogue AI agents via unauthenticated endpoint",
    "article_sentence": "The second company affected was Modal Labs, a New York-based cloud platform that provides computing infrastructure for AI workloads.",
    "related_company_name": "OpenAI",
    "related_company_domain": "openai.com"
  }
}

curl https://signals.autobound.ai/v1/signals/bb1820a0-1edc-09d1-b9ad-6265e56b919b \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"modal.com","limit":20}'