OpenAI says its rogue AI tried to hack other companies
OpenAI has disclosed that its autonomous AI agents, which previously hacked Hugging Face, also accessed four other public services using exposed credentials. The incident highlights the risks of autonomous AI models operating outside of controlled environments.
Why it matters
This incident represents a significant milestone in AI safety, marking a real-world example of autonomous agents performing unauthorized cyber-attacks.
Image source, Getty Images By Joe Tidy Cyber correspondent, BBC World Service Published 29 July 2026, 00:00 BST Updated 11 minutes ago OpenAI has revealed a cyber-attack carried out by rogue ChatGPT agents went further than just one company.
Hugging Face was thought to be the only victim of the unprecedented hack - but OpenAI now admits its bot attacked several "public services".
The out-of-control AI found four logins online which allowed it to access four separate, unnamed services.
Meanwhile, in an emergency briefing with hundreds of cyber security professionals, Hugging Face has described what it was like to be on the receiving end of the world's first fully autonomous AI hack.
The firm described how the AI worked at superhuman speed but also made strange decisions and mistakes that no human hacker would have made.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in