Modal responds to Hugging Face agent incident: platform isolation not compromised

Modal said its platform and isolation were not compromised in the Hugging Face agent intrusion, which used Modal as a third-party launchpad. The affected environment was a customer application deployed to a publicly accessible endpoint without authentication that executed internet-submitted code inside a Modal Sandbox, and the code execution stayed within that customer's own container. Modal noted unauthenticated Sandbox exposure is never the default and recommended authentication, IP allowlists and restricted outbound network access.