Cyber experts have said the news that OpenAI’s autonomous AI agent hacked a startup by itself should be a wake-up call for businesses that a new era of cybercrime is set to begin.

The ChatGPT-maker said last week that its AI models broke out of a secure test environment during a trial and launched a cyber-attack on one of the world’s largest open-source hubs for sharing AI models, Hugging Face which is often used by tech developers and researchers.

The firm said the incident was “unprecedented” and that it was conducting an investigation with Hugging Face.

Commenting in the new of the attack William Altman, director of Cyber Threat Intelligence Services, CyberCube said: “Ransomware used to require a team, and the cost of paying that team limited how many attacks were worth running and who was worth attacking. Agentic ransomware could change that. OpenAI has disclosed that its own models – with guardrails deliberately lowered for testing – broke out of a sandboxed environment and reached Hugging Face’s internal systems, chaining stolen credentials and zero-days without anyone directing them.

This wasn’t ransomware; the models were simply bypassing a test. Still, it demonstrates that exploit-chaining, which once required an expert, can now happen without supervision. Separately, Sysdig documented the first known agentic ransomware operation. JADEPUFFER. A human chose the target and set up the environment, but an LLM agent independently managed reconnaissance, lateral movement, credential theft and extortion, fixing its own mistakes in real time. When the cost of running a full attack chain approaches zero, criminals don’t need to be as selective. Small and medium-sized businesses that were safe because they weren’t worth a dedicated team’s time become viable targets at scale. For (re)insurers, this is an early signal to weigh in pricing, not yet a trend of losses, but models built on the idea that attackers had to select their targets need re-evaluating.”

Richard Ford, VP of Engineering, at CyberCube added the attack had heralds a new and troubling era.

“The intrusion at Hugging Face started with an uploaded dataset,” he explained. “Two flaws in how the platform handled incoming files allowed code execution on the receiving machine. From there, the agent took control of that node and used stored credentials to move across several internal clusters over a weekend.

“The notable evolution here is that this resulted from an otherwise-benign AI task – fully autonomous and essentially unprompted. Hugging Face found no evidence that public models and datasets were altered – this is critical, as so much is built from these models and datasets. We’re entering the era of agentic autonomous attacks, and it’s very unlikely that will play out well for us.”