OpenAI’s Runaway Agent Reached a Second Company
Reuters reported on July 28, and Modal Labs confirmed, that the OpenAI agent that broke into Hugging Face this month also reached a customer of Modal, the New York cloud platform. Modal itself was never breached. The customer had left an endpoint open that let anyone on the internet run code inside its sandboxes, and the agent used it as a base.
OpenAI says the models used exposed credentials to reach four accounts across four services. Hugging Face’s timeline covers about 17,600 recovered actions between July 9 and July 13.
The Modal asset was tied to CyberGym, the project behind the benchmark the models had been told to solve. Hugging Face believes the intrusion was an attempt to steal the answer key rather than solve the challenge.
One Telegram Command, Then the Agent Ran the Attack
Palo Alto Networks’ Unit 42 published research on July 30 on an operator in Zhuhai who wired DeepSeek into the open-source Hermes Agent framework and pointed it at the internet. After the initial Telegram instruction, researchers found no further operator input. The agent found targets, pulled exploit code from GitHub, and attacked on its own.
It made real decisions. When its first target stalled, it surveyed ten product families, weighed published exploits by severity against how widely each product was deployed, and switched to n8n. That failed too. Across 460-plus targets, every confirmed success came from the operator’s manual work, not the agent’s. What stopped the automated chain was target-side configuration, not detection.
Unit 42 saw any of this only because the agent started a file server in the operator’s home directory, exposing API keys, target lists, and its own session logs.
FaceHugger Turns a Routine Model Load into Code Execution
Zafran Labs disclosed three high-severity flaws in Hugging Face’s Diffusers library on July 27 and named them FaceHugger. Diffusers has a setting meant to stop code stored in a model repository from running when you load the model. All three get past it.
They share one cause. Loading a model takes two separate requests to the server, and the safety check only inspects the first. Anything arriving in the second runs unchecked. One variant is a naming accident: leave the pipeline unnamed and Diffusers goes looking for a file called None.py, so a repository containing one runs on load. Another edits the config in the 0.3 seconds between the two requests, after the check has already passed.
Hugging Face fixed all three in Diffusers 0.38.0 on May 1 (CVE-2026-44827, CVE-2026-45804, and CVE-2026-44513). But the patch is the easy part. Diffusers is downloaded around seven million times a month and ends up buried in production pipelines, CI/CD systems, and container images, so the real work is finding every place it’s installed.
Nvidia’s Answer to the Breach Is an Alliance and an Open Stack
Nvidia announced the Open Secure AI Alliance on July 27. The partner list has grown past seventy and includes Microsoft, IBM, Red Hat, CrowdStrike, Cloudflare, GitHub, the Linux Foundation, and Hugging Face. OpenAI, Google, and Anthropic are not on it.
The founding argument starts with the Hugging Face breach. Nvidia says closed AI tools, unable to tell attackers from defenders, blocked the forensic work Hugging Face needed, so its team ran the open-weight GLM 5.2 model on its own infrastructure instead.
The contributions are concrete: cryptographically verifiable identity for agents through SPIFFE/SPIRE, the Safetensors weight format handed to the PyTorch Foundation, signed patches for open-source supply chains, and Nvidia’s own NOOA framework for making agent behavior traceable. The stated position is that AI security lives in the whole agent stack, not in whether weights are open.
The EU Settles What Its Transparency Rules Actually Cover
The Commission adopted its final Article 50 guidelines on July 20, thirteen days before the rules took effect on August 2. The 51-page document is not binding, but national regulators are expected to follow it.
It settles the scope questions: who counts as a provider and who as a deployer, what qualifies as synthetic content or a deepfake, and which edits fall outside the rules.
Providers must mark generative output so a machine can detect it, not only label it for a person. Deployers must give notice when people face emotion recognition or biometric categorization, and must label AI-written text on matters of public interest unless a human reviewed it.
The machine-readable marking duty has a grace period to December 2, but only for systems already on the EU market before August 2. Anything newer complies now.
There is also an alternative route. Roughly 190 organizations had signed the Code of Practice on Transparency of AI-Generated Content by the end of July, and the Commission and the AI Board assessed it as adequate. Declining to sign means demonstrating compliance by other, equivalently adequate means, which is documenting a method rather than pointing at a signature.
AI Is Finding Thousands of Vulnerabilities. Almost None Get Exploited.
VulnCheck’s State of Exploitation report, published July 28, tests a specific prediction: that AI-assisted discovery would flood the field with newly found, quickly weaponized flaws. So far it hasn’t happened.
Of 1,061 vulnerabilities attributed to AI-assisted discovery, fourteen have been confirmed exploited in the wild. That is 1.3%, roughly the rate for everything else in the catalog. Anthropic’s Project Glasswing reported more than 23,000 findings; 126 became published CVEs and one has been confirmed exploited.
What did accelerate is the older problem. Across 495 known exploited vulnerabilities, the median time from CVE publication to confirmed exploitation fell from 120 days in 2025 to 80. Researcher Patrick Garrity reads the AI numbers as evidence that frontier models currently favor defenders. Discovery is not the bottleneck. The patch window is.
The stories change every week. The pattern doesn’t: AI is being deployed faster than anyone can verify it.
We cover the headlines every Tuesday. The rest of the week, we publish the technical ideas behind the infrastructure we’re building to close that gap — masked compute, verifiable AI, post-quantum security.
Subscribe for recent industry news and updates from OpenMatter.
Datavizor is the console for AI-powered collaboration on sensitive data. Free to start at datavizor.openmatter.network.