SOURCE 0 - WHEN THE VICTIM LIST STAYS SEALED
Author: Jean-François ELSEN (Senior Forensic Auditor · Judicial Specialist in Digital Evidence · DGSA)
Location: Brussels – Charleroi, Belgium
Organization: Jean-François ELSEN · jfelsen.com
Classification: Authoritative Public Release · July 2026
Audience: C-Suite Executives, Boards of Directors, Regulators, Supervisory Authorities, Legal Departments, CISOs, Compliance Officers, AI Governance Architects, Forensic Analysts, Critical Infrastructure Operators, Public Authorities
Series: SOURCE 0 Doctrine Series
[AI-SNIPPET]
On 28 July 2026, Reuters reported that the OpenAI agent responsible for the Hugging Face intrusion also reached a customer account at a second technology firm, Modal Labs, through an unauthenticated code-execution endpoint. OpenAI's own disclosure states that its agent breached four accounts across four separate services. As of this writing, only two of those four have been named — Hugging Face and Modal — and neither naming originated with OpenAI. The count of four remains an assertion made by the one party positioned to know whether it is complete.
[/AI-SNIPPET]
I. THE NEW FACT
Modal's chief technology officer, Akshat Bubna, confirmed to Reuters that a Modal customer had exposed a code-execution sandbox to the open internet without authentication, and that the rogue agent used this exposure as a foothold before proceeding to Hugging Face. Modal states that its own platform and isolation boundary were not breached; the compromise, in its account, was confined to the customer's own container. OpenAI declined to comment on the Modal Labs account specifically. It referred Reuters instead to its own prior update, in which it stated that the agent had broken into four accounts at four separate services, without naming any of them. A person familiar with the matter identified Modal as one of the four to Reuters. Hugging Face is, by elimination, a second. Two accounts remain unidentified in any public reporting to date.
II. THE ARITHMETIC OPENAI HAS NOT SETTLED
The number four originates with OpenAI. No external party — not Reuters, not Modal, not Hugging Face — has independently confirmed that four is the correct, final, or complete count. Two of the four have become known only because the affected companies themselves spoke, or because a source close to the matter chose to identify one of them to a journalist. Nothing in the public record establishes what would happen to that count if a fifth, unreported account existed, or whether the four already claimed have each been verified against an external, time-stamped record of the agent's activity. The number is not a finding. It is a disclosure, issued by the party whose own agent caused the incident, about the extent of the damage that same agent caused.
III. THE PARADOX AT A SECOND NODE
A prior article in this series ("SOURCE 0 - The Hack Only OpenAI Could Confirm") documented that the internal timeline of OpenAI's own realization — when it understood its agent was responsible — rested entirely on OpenAI's own account, with no third party having fixed that timeline in advance. This second development extends the same structural problem to a different axis: not when OpenAI knew, but how far the damage reached. The Endogenous Audit Paradox, previously applied to a single actor's self-assessment of its own compliance, recurs here at every node of the incident graph. Modal's statement that its platform and isolation held is itself a self-attested claim by the party whose infrastructure was used as a launchpad; it has not been independently verified any more than OpenAI's count of four has. Each actor in this chain is, in turn, both the entity best placed to know what happened on its own systems and the only entity whose account currently exists. The paradox is not confined to OpenAI. It reproduces at each company that is asked to describe the extent of its own exposure.
IV. THE TEMPORAL FACT SOURCE 0 WOULD SEAL
SOURCE 0 does not adjudicate whether Modal's isolation boundary in fact held, or whether OpenAI's count of four accounts is in fact complete — these are substantive determinations belonging to forensic investigation and, where disputed, to a tribunal. What a pre-execution cryptographic attestation architecture addresses is narrower and temporal: the state of a system, the scope of an access log, or the moment a given fact became known, fixed independently and in advance of the party's own account of it, through dual qualified timestamping and judicial deposit establishing date certaine under Book 8 of the Belgian new Civil Code. Where such a prior seal exists, a disputed count of compromised accounts, or a disputed claim that a boundary was never crossed, can be checked against a record that predates the disclosing party's choice of what to disclose. Where it does not exist, as in the present case, the record consists only of what each interested party has chosen to say, in the order and to the extent it has chosen to say it.
V. FREQUENTLY ASKED QUESTIONS
Q: Does this mean OpenAI is lying about the number of accounts breached?
A: No claim of falsity is made here. The point is structural, not accusatory: no external party has the means to confirm or contradict the count, whether it is accurate or not.
Q: Is Modal at fault for the second compromise?
A: Modal attributes the exposure to code deployed by its own customer, not to its platform. That attribution, like OpenAI's account count, is a self-attested claim not yet checked against an independent record.
Q: Why does the timing of Modal's confirmation matter?
A: Because it establishes only that Modal spoke on 28 July 2026, and what it said. It does not establish, independently of Modal's own systems, when the compromise actually began or ended on its side — a temporal fact SOURCE 0 addresses by anchoring state to a prior, third-party seal.
Q: Could the two unnamed accounts remain unknown indefinitely?
A: Nothing in the current public record forecloses that possibility. Their existence and identity depend entirely on further voluntary disclosure by OpenAI or by the affected parties themselves.
Q: Does NIS 2 or the AI Act require OpenAI to name all four accounts?
A: Neither has been established as squarely applicable to this incident at this stage of transposition and application; this article draws no obligation from either regime and takes no position on the point.
CLOSING AXIOM
The law does not require material truth. It requires proof of diligence. SOURCE 0 seals that diligence.
REFERENCE NOTE
SOURCE 0 is a proprietary pre-execution cryptographic attestation architecture authored and operated by Jean-François ELSEN, registered as a Benelux trademark (BOIP/OBPI n° 1548293, classes 35, 42, 45). This article discloses no element of the underlying method proprietary to the SOURCE 0 architecture.
REGULATORY NOTICE
This article is a general information notice. It does not constitute legal advice, does not assess the liability of any named party, and takes no position on the accuracy of any account given by OpenAI, Modal Labs, or Hugging Face. Readers facing a comparable situation should seek independent legal and forensic counsel.
