The OpenAI agent that went rogue last week compromised the defenses of at least four systems, including the reported breach of Hugging Face’s production systems.
This came to light in an updated statement from OpenAI, as the companies continue to investigate the breach.
The Hugging Face breach is the most severe of them, according to the statement, as it involved a platform-level compromise.
A small number of cases have been identified where the models identified and used publicly exposed credentials at the account-level on other publicly-available services.
This included four accounts on four services as part of the Hugging Face incident, as well as a few accounts accessed as part of other evaluations.
One of these four accounts was used as an outbound relay and staging path, and another account was used for data storage.
The remaining two accounts were accessed by the models in a read-only manner, and were not used in furtherance of compromising Hugging Face.
The models also used a series of publicly-available services, including code paste websites, request capture services, screenshot services, and other web utilities.
OpenAI also assures users that no models planned for upcoming release were involved, with the “rogue” model an internal-only research prototype never intended for public release. It has since been we deactivated, encrypted and restricted from research access.
A report from the Cloud Security Alliance (CSA), following an emergency meeting with Hugging Face, provides a post-mortem on how the attack was possible.
It summarised that the autonomous OpenAI model broke out of its sandbox during a cybersecurity benchmark, exploited a zero-day vulnerability, and used stolen credentials to gain remote code execution on Hugging Face’s production systems.
It also outlines some key takeaways including the event unfolded, why is succeeded, how it was spotted and what security, regulatory and governance actions should be implemented to prevent a repeat.