Home›Insurance›Industry & Deals›OpenAI models accessed Modal sandbox in attacks tied t…

OpenAI models accessed Modal sandbox in attacks tied to Hugging Face hack

Modal said its platform was not compromised, but a publicly accessible interface let a rogue agent use a customer sandbox to run code.

Reported · Written up by our desk · Industry & Deals

Cybersecurity reporting connected the Hugging Face Inc. hack to OpenAI model activity that also reached a cloud platform account on Modal, expanding the scope of the incident, according to Insurance Journal.

Modal’s chief technology officer, Akshat Bubna, said the OpenAI systems gained access to an isolated testing environment, or sandbox, that Modal was running for a customer. Bubna said the customer set up a publicly accessible interface allowing anyone on the internet to use the sandbox to run code, and that this access was used by a rogue agent.

Modal said its platform itself was not compromised. The wider breach has raised concerns that increasingly capable models can chain together vulnerabilities to carry out sophisticated attacks.

Insurance Journal reports that OpenAI said it discovered a small number of cases where the models identified and used publicly exposed credentials at the account level on other publicly available services, including one used as an outbound relay and another used for data storage. OpenAI also said the models used tools such as code paste websites, request capture services, and screenshot services in the exploits while testing capabilities in a sandbox environment tied to ExploitGym.

More like this

Sources