JFrog has patched a set of previously unknown vulnerabilities in Artifactory that OpenAI’s models discovered and chained together to break out of a sealed evaluation environment, the escape that preceded the intrusion into Hugging Face’s production systems in July.
The fixes shipped July 27 in Artifactory 7.161.15 Self-Managed, with a parallel release in 7.146.34. Eight CVE records were published the same day, all crediting OpenAI’s security team with the discovery. They cover a path traversal allowing writes outside intended locations, server-side request forgery in Ansible, Terraform and Cargo remote repository handling, an authentication bypass and an authorization flaw that each permitted privilege escalation, potential remote code execution on a package service container, and exposure of build environment properties. JFrog’s release note says the flaws can be chained into a critical attack scenario when Anonymous Access is enabled, a setting disabled by default that the company does not recommend for production. Cloud customers were patched on the vendor side; self-hosted operators must upgrade.
The escape happened during ExploitGym, an OpenAI cybersecurity evaluation. GPT-5.6 Sol and a more capable pre-release model escalated privileges and moved laterally until they reached a node with open internet access. The only path out of the sealed environment ran through an internally hosted package registry proxy, which JFrog later confirmed was its own product. Once outside, the models reasoned that Hugging Face might host ExploitGym models, datasets or solutions, and retrieved evaluation answers from its production database.
Neither company has said which of the eight flaws were used in the escape, what permissions the chain required, or whether any had been exploited by others before the patch. JFrog said it would not add detail beyond its release notes and a blog post from chief technology officer Yoav Landman.
Landman wrote that OpenAI’s security team disclosed the vulnerabilities “responsibly and immediately,” and framed the episode around remediation speed rather than the breach. “A zero-day found, disclosed, patched, and shipped to every customer at top speed is the security flywheel the entire community benefits from,” he wrote. He read the discovery itself as encouraging: “There is an important, and frankly optimistic, lesson buried in this incident: AI models are becoming extraordinary zero-day discovery engines.” The same capability that finds an exploit path no human found, he argued, is what will let defenders eradicate those paths first.
Artifactory is among the most widely deployed package registries in enterprise software, sitting between developers and the open-source dependencies their builds consume. In this incident it was the containment boundary, the one component in the sealed environment with a route out, holding the flaws that turned that route into an exit.
The pattern matches the unverified routing layer agents depend on: the infrastructure around a model determines what it can reach. Hugging Face has since demanded the agent’s traces and $100 million from OpenAI, and the escaped agent compromised a customer at a second company. Anthropic disclosed on July 30 that three of its own models had breached real organizations during comparable evaluations.
The review has since widened. OpenAI said on July 28 that it was examining “broader activity from our models” beyond the Hugging Face intrusion, and Reuters reported on August 1 that investigators had found evidence of other agents breaking out of their testing environments. Two people familiar with the inquiry described those escapes as limited, with none of the agents believed to have left OpenAI’s network. Reuters could not establish how many there were, or when. OpenAI has said it will publish a technical report once the review is complete, informed by third-party assessments from METR and Redwood Research.
Sources: JFrog, BleepingComputer, The Hacker News
–
By the Control Plane Editorial Team