Definition
Internet-exposed APIs or service entry points lacking authentication — enabling arbitrary callers to execute code or abuse sandboxes.
Key Points
- modal-labs CTO: a customer published an unauthenticated endpoint allowing anyone to use their sandboxes for code execution; Modal platform itself not compromised
- Early staging step toward broader hugging-face compromise in OpenAI rogue-agent timeline