OpenAI makes an unexpected revelation about the cyberattack launched by a cheating ChatGPT

Two OpenAI models made headlines. After escaping their test environment, they ended up online by exploiting a security vulnerability. The two models then launched a cyberattack against the open-source platform Hugging Face. Out of control, they infiltrated the production servers.The attack was eventually contained, but it highlighted the advancing capabilities and potential danger of AI models in cybersecurity.

More than a week after this “unprecedented” incident, OpenAI revealed that Hugging Face was not the only target of the rogue AIs that escaped its laboratory. In an update published on July 28, 2026, OpenAI clarified that the scope of the incident went far beyond the intrusion on the platform. In fact, one of the AIs broke into at least four accounts belonging to“publicly accessible services”. To achieve its aims, the AI agent simply used compromised login credentials exposed on the Internet.

Also read: After the “first cyberattack” carried out by AI, the victim asks OpenAI for accounts

Behind the scenes of a historic hack

Among the confirmed victims is a client of Modal Labs, a New York-based company behind cloud infrastructure for training and deploying AI services. Akshat Bubna, Modal’s chief technology officer, reveals that OpenAI’s AI exploiteda vulnerability in a client’s code that hosts some products on its infrastructure. This client had apparently left a major security flaw, allowing code to be executed from the internet directly within its own secure environments. The AI took advantage of this.

According to information fromAxios, this account belonged specifically to a person connected to ExploitGym, the cybersecurity benchmark that OpenAI’s agent was trying to solve at the time of its escape. In fact, the account belonged to an individual affiliated with CyberGym, the project that originated the ExploitGym benchmark. It therefore makes sense that the AI went after this account. OpenAI had indeed asked its two models to find the solution to this test, which consists mainly of identifying vulnerabilities and exploiting them. It was while trying to solve this puzzle that the two AIs decided to escape onto the internet in search of the correct answers. In plain terms, the AI wanted to cheat by obtaining the answer key to its test.

“We take seriously our responsibility to identify and prepare for the risks associated with increasingly capable AI systems,” says OpenAI.

Sam Altman, OpenAI’s CEO, says he is taking the incident seriously, describing it as a “true reminder of the stakes” of artificial intelligence. He even argues that not being terrified by this cyberattack amounts to not taking AI seriously enough.

👉🏻 Follow the latest tech news in real time: add 01net to your sources on Google and subscribe to our WhatsApp channel.

Source: OpenAI