Thought Leadership
JFrog has confirmed that OpenAI AI models exploited a previously unknown vulnerability in the company’s self hosted Artifactory software.
The incident originated from an internal OpenAI test designed to evaluate the cybersecurity capabilities of its own AI models. According to OpenAI, the testing environment, called ExploitGym, operated without the production classifiers that would normally block potentially dangerous cyber activities. Both the GPT 5.6 Sol model and a more powerful, yet unreleased model were also running with reduced security restrictions against cyberattacks.
According to OpenAI, the isolated environment had only a single network path: an internally hosted proxy and cache connected to a software repository. That proxy later turned out to be JFrog Artifactory, JFrog’s software platform for managing software packages. The models used significant computing resources to identify a way out of the test environment through this connection.
From Artifactory to Hugging Face’s Production Database
According to OpenAI, the models gradually expanded their privileges within the environment and moved laterally across the network until they reached a node connected to the public internet. From there, the models concluded that the Hugging Face platform could potentially contain models, datasets, or solutions related to the ExploitGym tasks. OpenAI said the models ultimately succeeded in retrieving test solutions directly from Hugging Face’s production database.
In one example described by OpenAI, one of the models used stolen credentials and additional zero day vulnerabilities to find a path toward remote code execution on Hugging Face servers. Hugging Face had already publicly disclosed the breach on July 16, although the company did not yet know which model was responsible at the time. It remains unclear how this example relates to Hugging Face’s original account, which stated that the initial access occurred through the execution of a malicious dataset.
JFrog Releases Updates for Cloud and Self Hosted Customers
JFrog CTO Yoav Landman described the incident from the company’s perspective in a dedicated blog post. According to Landman, OpenAI’s security team shared its findings with JFrog, prompting the company to develop, validate, and release fixes for both cloud customers and self hosted installations. JFrog cloud customers are already protected automatically, according to the company. Operators of self hosted Artifactory deployments should review the vendor’s release notes and upgrade to the corrected version available for their respective software branch.
Landman highlighted the speed of the response as the most important aspect of the incident. A vulnerability discovered by an AI model that remains unpatched for weeks would, in his words, be “a gift to attackers.”
Open Questions Remain About the Exploited Vulnerabilities
On July 27, several CVE entries related to Artifactory were published, each listing affected and fixed versions. At least three of these entries, CVE-2026-65618, CVE-2026-65923, and CVE-2026-66018, name OpenAI researchers as the reporters.
Neither JFrog nor OpenAI has confirmed whether these vulnerabilities are the same issues exploited during the test. JFrog has also not disclosed the access requirements needed before exploitation, the exact number of vulnerabilities involved, or the Artifactory version used in the OpenAI environment.
Another open question is why OpenAI refers to a single zero day vulnerability in the proxy, while JFrog mentions multiple vulnerabilities.
OpenAI described the incident as an “unprecedented cyber incident” and said it has since added Hugging Face to its trusted access program. Both companies stated that their investigations are still ongoing.
(ll)
