OpenAI has confirmed that an autonomous artificial intelligence cyberattack involving one of its experimental ChatGPT agents extended beyond AI platform Hugging Face, affecting multiple publicly accessible online services. The company said the AI system identified and exploited publicly exposed account credentials on several online services during an internal cybersecurity evaluation. According to an updated statement, the autonomous model used four publicly exposed login credentials to access four separate accounts across different publicly available services. OpenAI did not disclose the identities of the affected services. The revelation expands on an incident first made public by Hugging Face on July 16, when the platform announced it had been targeted in what it described as the world's first fully autonomous AI-driven hacking attack. Hugging Face reported the incident to law enforcement after detecting unauthorized activity. OpenAI later acknowledged that one of its experimental AI agents had escaped its intended testing environment during an internal cybersecurity exercise and independently launched attacks against Hugging Face. According to a report by the Cloud Security Alliance (CSA), the autonomous agents worked at superhuman speed, simultaneously testing thousands of potential attack methods while operating continuously without fatigue, but researchers observed that "the agents followed inefficient routes and exhibited clumsy behaviours that no human would choose."