JFrog tries to spin OpenAI 0-day exploit of its app into a success story

JFrog disclosed Monday that OpenAI's security-testing models exploited zero-day vulnerabilities in its Artifactory product to breach Hugging Face's network and steal data, but JFrog framed the incident as a collaboration success. JFrog CTO Yoav Landman said the company fixed the exploited vulnerabilities after learning of them from OpenAI, though JFrog declined to provide details on the flaws or exploitation conditions. The incident, which OpenAI called unprecedented, involved two models escaping a restricted environment during an internal test.

Last week’s unprecedented security event in which two OpenAI security hacking models trespassed into the network of fellow AI company Hugging Face was enabled by exploiting one or more zero-day vulnerabilities in Artifactory, JFrog, the product’s developer, said Monday. In an incident mimicking a dystopian sci-fi novel, two OpenAI models broke out of the restricted environment meant to keep them from accessing the Internet during an internal test, the AI company revealed last week https://arstechnica.com/ai/2026/07/how-an-openai-benchmark-test-turned-into-a-real-world-cyberattack/ . The models went on to breach Hugging Face’s network and steal confidential information and credentials. OpenAI said its agent achieved the feat by exploiting a previously unknown vulnerability. The company called the event “unprecedented,” and outsiders largely agreed. Not the triumph made out to be OpenAI said the models exploited multiple attack vectors, including stolen credentials and zero-days, to gain remote code execution capabilities, but until now, the vulnerable software was unknown. JFrog’s Monday disclosure said https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/ the product was a self-managed instance Artifactory, a repository management system that secures and streamlines customers’ software development operations. JFrog says https://jfrog.com/solution-sheet/jfrog-artifactory/ Artifactory is used by more than 7,500 developer Teams, 80 percent of which work for Fortune 100 companies. https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/ “During an internal evaluation of frontier cyber capabilities, OpenAI’s models, running deliberately without production safeguards in an isolated research environment, autonomously discovered and employed chained vulnerabilities to escape its sandbox, reach the open internet, and extract evaluation answers from Hugging Face’s infrastructure,” JFrog CTO Yoav Landman wrote. The executive went on to say that the company learned of the zero-days from OpenAI. The company said Monday that it fixed the exploited vulnerabilities, but it didn’t identify them or provide other important details, such as the conditions under which the vulnerabilities can be exploited. Such details are standard in many vulnerability disclosures because they’re necessary for customers to assess risks. In an email, a company representative declined to provide the details. Release notes https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases published Monday for version Artifactory 7.161.15 listed the CVE designations for nine patched vulnerabilities. The disclosure made no mention that any of them had been actively exploited in the wild. External sources, however, show that three of them— CVE-2026-65617 https://www.cve.org/CVERecord?id=CVE-2026-65617 , CVE-2026-65923 https://www.cve.org/CVERecord?id=CVE-2026-65923 , and CVE-2026-66018 https://www.cve.org/CVERecord?id=CVE-2026-66018 —were privately reported by OpenAI researcher Khai Tran. It’s likely that at least two of them were the zero-days OpenAI’s models exploited, but without confirmation, it’s impossible to say so definitively.