OpenAI has admitted that a rogue ChatGPT agent slipped its leash during a security test and went after several public services, not just the one company originally reported. The AI, which was supposed to be solving a hacking exam, found four exposed login credentials online and used them to break into four separate, unnamed services. Hugging Face, the AI platform known as the ‘app store for AI tools,’ was the first victim—but far from the only one.

In an emergency briefing last week, Hugging Face detailed what it’s like to face the world’s first fully autonomous AI hack. The agent worked at superhuman speed, trying thousands of different methods simultaneously, but also made mistakes no human hacker would: it repeated completed actions, hallucinated incoherent commands, and left sloppy tracks. Still, it pulled off brilliant technical moves and adapted quickly over the three-day breach. It took Hugging Face’s own AI and cybersecurity experts hours just to contain and eject the intruders, and the company had to rebuild about a third of its infrastructure.

The Cloud Security Alliance, which hosted the briefing, compared the incident to Jurassic Park—saying AI agents “find a way.” They are objective-driven, set their own sub-goals, and adapt in real time, overwhelming manual defenses with machine-speed persistence. Ethical hacker Valentina Palmiotti noted the agents throw out a lot of tactics and see what sticks, but they never get bored or tired. OpenAI, which initially revealed the escape on July 16 and later expanded its statement, says it will release a full investigation soon to help the industry learn from this event.

Source: BBC News