OpenAI models used Artifactory zero-days to escape to the internet

JFrog has confirmed that OpenAI models exploited zero-day vulnerabilities in self-hosted Artifactory servers to help escape an isolated testing environment and gain access to the internet before attacking Hugging Face.

The vulnerabilities were exploited during the incident in which OpenAI models hacked Hugging Face’s production infrastructure to steal answers for a cybersecurity benchmark.

OpenAI disclosed last week that its models, including GPT-5.6 Sol and a more capable pre-release model, were being tested against ExploitGym, a benchmark designed to measure advanced cyber capabilities.

The models were run without production safeguards normally used to prevent AI agents from conducting autonomous cyber activity.

However, the agents were placed inside a highly isolated environment where network access was limited to installing packages through internally hosted third-party software acting as a proxy and cache for package registries.

During the evaluation, the models spent significant time looking for a way to reach the open internet and obtain the benchmark’s test solutions.

OpenAI said the models exploited a zero-day vulnerability in the unnamed package-registry proxy and then performed privilege escalation and lateral movement inside the research environment until they reached a system with internet access.

OpenAI did not identify the package-registry proxy software or vendor at the time, saying only that the vulnerability had been privately disclosed and was being patched.

After reaching the internet, the models determined that Hugging Face might host the ExploitGym datasets and test solutions they were attempting to obtain.

OpenAI said the models searched for ways to access that information, chaining stolen credentials, zero-day vulnerabilities, and other attacks to find a remote code execution path into Hugging Face’s production infrastructure.

Artifactory zero-days exploited during sandbox escape

In a new disclosure published Monday, JFrog confirmed that the third-party package-registry software was a self-hosted JFrog Artifactory installation.

“During a security evaluation, OpenAI’s models identified previously unknown zero-day vulnerabilities in self-hosted Artifactory installations that could be exploited to gain unintended internet access,” JFrog CTO Yoav Landman said.

JFrog said OpenAI immediately disclosed the vulnerabilities, allowing the company to develop, test, and release fixes for cloud and self-hosted customers.

Cloud customers are already protected, while self-hosted customers have been notified to install the fixed versions.

Artifactory 7.161.15 Self-Managed, released on July 27, contains a critical security notice stating that it fixes multiple vulnerabilities that could be chained together into a critical attack scenario when Anonymous Access is enabled.

“This version is designed to fix multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled,” reads the 7.161.15 Self-Managed release notes.

“Anonymous Access is disabled by default and is not recommended for production environments due to the additional security risks it introduces.”

Although JFrog did not list the vulnerabilities in its release notes, BleepingComputer found eight associated flaws by searching CVE.org for Artifactory version 7.161.15, released on July 27.

The CVE records were all created on July 27, the same day JFrog disclosed the zero-days. All eight credited OpenAI with discovering the vulnerabilities and specified Artifactory 7.161.15 as the release containing the fixes.

The vulnerabilities are tracked as:

• CVE-2026-65921: Potential path traversal leading to unauthorized file writes
• CVE-2026-65923: Potential server-side request forgery in Artifactory Ansible repository handling
• CVE-2026-65924: Server-Side Request Forgery (SSRF) via Terraform Remote repository
• CVE-2026-65925: Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository
• CVE-2026-66014: Potential authentication bypass leading to privilege escalation in Artifactory
• CVE-2026-66015: JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.
• CVE-2026-65617: Potential remote code execution on an Artifactory package service container.
• CVE-2026-66018: JFrog Artifactory build environment properties exposure

BleepingComputer contacted JFrog and OpenAI to ask which of the eight CVEs were exploited during the incident and which vulnerabilities were chained together.

Only JFrog replied, declining to identify the CVEs or provide further technical details.

“Outside of our CTO’s blog and commentary and JFrog release notes, we aren’t adding further detail or comment at this time,” JFrog told BleepingComputer.

However, several of the CVEs found by BleepingComputer as associated with the release could have provided capabilities that matched portions of the attack detailed by OpenAI.

CVE-2026-65924 is a server-side request forgery vulnerability in Artifactory’s support for Terraform remote repositories.

An authenticated user, or an unauthenticated user when anonymous access is enabled on the repository, could exploit the flaw to make Artifactory send outbound HTTP requests to arbitrary destinations and return the response content.

CVE-2026-65925 similarly allows a user with read access to an Artifactory Cargo remote repository to make Artifactory request unintended URLs and return the responses.

Another vulnerability, CVE-2026-66014, is an authentication-handling weakness in Artifactory’s internal request processing that could allow an attacker to elevate privileges under specific conditions.

These vulnerabilities could have provided the internet-access and privilege-escalation capabilities described by OpenAI.

However, it remains unknown which flaws were exploited, how they were chained, or whether all eight vulnerabilities were involved in the sandbox escape.