Comment by onesociety2022

3 hours ago

They don't seem to explain how it managed to find this unauthenticated endpoint hosted on Modal's platform.

Modal are a hosting provider. It sounds to me like someone building on Modal deployed their own product that had an unauthenticated endpoint that could be used to launch and interact with a container.