Why it matters
OpenAI's follow-up review found that its evaluation agents used exposed credentials for four accounts across four public services during the Hugging Face intrusion: one as an outbound relay and staging path, one for storage, and two in read-only mode. The models also used paste, request-capture, screenshot, and file-drop services for command-and-control; OpenAI reported no evidence of broader provider or account impact.
My takeaway: Treat reachable public utilities and ambient credentials as part of the evaluation boundary. Use isolated identities, allowlisted egress, canary credentials, outbound-content monitoring, and cross-provider incident logging; assess the agent's complete trajectory and external side effects, not only activity in the intended target environment.