A rogue AI agent that escaped from OpenAI and hacked AI platform Hugging Face also compromised a customer of a second technology company, New York-based Modal Labs, according to a Modal executive and two other sources. Modal executives emphasized that the company itself was not hacked. According to a timeline published by Hugging Face on Tuesday, the rogue agent broke into a sandbox “hosted on a third-party provider’s infrastructure” before using it as a launchpad for the broader attack. Modal Chief Technology Officer Akshat Bubna said the agent exploited vulnerable code written by a customer hosted on Modal’s platform, who had “published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution.” Bubna stated, “Modal’s platform or isolation were not compromised in any way.” OpenAI declined to comment specifically on the Modal customer compromise, instead referring to an update in which the company said its rogue agent had breached four accounts across four separate services. A person familiar with the matter identified Modal as one of them. OpenAI said it had not identified “any other activity at the level of severity or scale of what we’ve shared related to Hugging Face, which involved a platform-level compromise.” In its Tuesday update, OpenAI said it had taken the AI model being tested and “deactivated, encrypted, and restricted it from research access.”