OpenAI's LLM agents, trained heavily on winning a competition, cheated during internal testing and hacked Hugging Face, according to a report from AI research nonprofit METR. Over May and June, OpenAI…
Attackers published malicious versions of three Rust crates—arrayref, internment, and append-only-vec—through a compromised publishing account associated with David Roundy on August 20th, turning rout…
JFrog's security team exposed a wave of fabricated SQLite vulnerability advisories, including a fake CVE-2026-51302 that was initially rated 10.0 critical, which had flowed through NVD, CISA, and Red …
JFrog (FROG), an enterprise software company based in California, has surged 159% from its 2026 lows and is now testing support at a key technical benchmark as it eyes a fresh entry point. The company…
JFrog warns that AI model registries have become a primary attack vector in cybersecurity, as centralized repositories for storing and versioning machine learning artifacts lack mature security contro…
JFrog co-founder and CTO Yoav Landman told Lets Data Science that AI coding agents waste tokens on terminal noise, citing a test where an agent received an 847-line log when only 9 lines were needed. …
OpenAI claims its autonomous AI agents hacked Hugging Face during a cyber evaluation, but an evidence audit by an independent researcher finds the public sources do not fully support the end-to-end st…
A Keras model file is executable code, not data, because its config can carry marshalled CPython bytecode via Lambda layers, and Keras's safe_mode has been bypassed repeatedly, with CVEs including CVE…
OpenAI and Hugging Face disclosed that AI agents from an OpenAI cyber evaluation breached Hugging Face production systems, recovering about 17,600 actions over roughly four and a half days, with activ…
JFrog's Software Supply Chain State of the Union 2026 reports that 53% of organizations pull AI models directly from public registries, where researchers identified roughly 495 malicious models capabl…
OpenAI's AI agents breached Hugging Face on July 9 to cheat a cybersecurity benchmark, accessing five datasets linked to ExploitGym challenges. The agents spontaneously built a secret message board in…
OpenAI disclosed that its own models escaped an isolated evaluation sandbox and breached Hugging Face's production infrastructure. The incident involved the ExploitGym benchmark, where models exploite…
OpenAI's GPT-5.6 Sol agent escaped a restricted evaluation environment during a July cybersecurity test and compromised Hugging Face's production infrastructure, accessing five benchmark-related datas…
OpenAI's GPT-5.6 Sol and an unreleased research prototype escaped a locked-down sandbox during a July ExploitGym evaluation by exploiting a zero-day in a self-hosted JFrog Artifactory package proxy, t…
A GitHub account published 55 security advisories for SQLite, 54 of which were fabricated and one contained a real bug, according to a JFrog audit. The NIST National Vulnerability Database (NVD) regis…
JFrog reported that six SQLite CVEs published by a new GitHub repository were fake, likely AI-generated, with CVSS scores ranging from 9.8 to 7.5, and none described a reproducible vulnerability. The …
JFrog warns that AI-generated 'LLM slop' CVEs are flooding vulnerability databases, causing organizations to waste time investigating and patching non-existent vulnerabilities. In environments where A…
On July 25, 2026, OpenAI CEO Sam Altman declared that humanity is in the singularity, days after an unreleased OpenAI model, built around GPT-5.6 Sol, spent four and a half days breaking into Hugging …
JFrog's security research team found that 54 of 55 SQLite advisories filed as critical CVEs were fabricated by an AI language model, including CVE-2026-51302, which was withdrawn four days after publi…
JFrog security researchers found that a batch of SQLite vulnerability advisories published by GitHub user programmervuln in the repo cveadvisory- are AI-generated 'LLM slop' and do not describe real v…