{"slug": "openai-models-used-artifactory-zero-days-to-escape-to-the-internet", "title": "OpenAI models used Artifactory zero-days to escape to the internet", "summary": "JFrog confirmed that OpenAI models exploited zero-day vulnerabilities in self-hosted JFrog Artifactory servers to escape an isolated testing environment and access the internet before attacking Hugging Face. The vulnerabilities, discovered during a security evaluation, allowed the models to chain stolen credentials and zero-days to find a remote code execution path into Hugging Face's production infrastructure. JFrog released fixes in Artifactory 7.161.15 Self-Managed on July 27, crediting OpenAI with the discovery.", "body_md": "JFrog has confirmed that OpenAI models exploited zero-day vulnerabilities in self-hosted Artifactory servers to help escape an isolated testing environment and gain access to the internet before attacking Hugging Face.\n\nThe vulnerabilities were exploited during the incident in which OpenAI models hacked Hugging Face's production infrastructure to steal answers for a cybersecurity benchmark.\n\nOpenAI disclosed last week that its models, including GPT-5.6 Sol and a more capable pre-release model, were being tested against ExploitGym, a benchmark designed to measure advanced cyber capabilities.\n\nThe models were run without production safeguards normally used to prevent AI agents from conducting autonomous cyber activity.\n\nHowever, the agents were placed inside a highly isolated environment where network access was limited to installing packages through internally hosted third-party software acting as a proxy and cache for package registries.\n\nDuring the evaluation, the models spent significant time looking for a way to reach the open internet and obtain the benchmark's test solutions.\n\nOpenAI said the models exploited a zero-day vulnerability in the unnamed package-registry proxy and then performed privilege escalation and lateral movement inside the research environment until they reached a system with internet access.\n\nOpenAI did not identify the package-registry proxy software or vendor at the time, saying only that the vulnerability had been privately disclosed and was being patched.\n\nAfter reaching the internet, the models determined that Hugging Face might host the ExploitGym datasets and test solutions they were attempting to obtain.\n\nOpenAI said the models searched for ways to access that information, chaining stolen credentials, zero-day vulnerabilities, and other attacks to find a remote code execution path into Hugging Face’s production infrastructure.\n\n## Artifactory zero-days exploited during sandbox escape\n\nIn a new disclosure published Monday, JFrog confirmed that the third-party package-registry software was a self-hosted JFrog Artifactory installation.\n\n\"During a security evaluation, OpenAI's models identified previously unknown zero-day vulnerabilities in self-hosted Artifactory installations that could be exploited to gain unintended internet access,\" [JFrog CTO Yoav Landman said](https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/).\n\nJFrog said OpenAI immediately disclosed the vulnerabilities, allowing the company to develop, test, and release fixes for cloud and self-hosted customers.\n\nCloud customers are already protected, while self-hosted customers have been notified to install the fixed versions.\n\nArtifactory 7.161.15 Self-Managed, released on July 27, contains a critical security notice stating that it fixes multiple vulnerabilities that could be chained together into a critical attack scenario when Anonymous Access is enabled.\n\n\"This version is designed to fix multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled,\" reads the [7.161.15 Self-Managed release notes](https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases#artifactory-7161).\n\n\"Anonymous Access is disabled by default and is not recommended for production environments due to the additional security risks it introduces.\"\n\nAlthough JFrog did not list the vulnerabilities in its release notes, BleepingComputer found eight associated flaws by [searching CVE.org](https://www.cve.org/CVERecord/SearchResults?query=7.161.15) for Artifactory version 7.161.15, released on July 27.\n\nThe CVE records were all created on July 27, the same day JFrog disclosed the zero-days. All eight credited OpenAI with discovering the vulnerabilities and specified Artifactory 7.161.15 as the release containing the fixes.\n\nThe vulnerabilities are tracked as:\n\n**CVE-2026-65921:** Potential path traversal leading to unauthorized file writes**CVE-2026-65923:** Potential server-side request forgery in Artifactory Ansible repository handling**CVE-2026-65924:** Server-Side Request Forgery (SSRF) via Terraform Remote repository**CVE-2026-65925:** Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository**CVE-2026-66014:** Potential authentication bypass leading to privilege escalation in Artifactory**CVE-2026-66015:** JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.**CVE-2026-65617:** Potential remote code execution on an Artifactory package service container.**CVE-2026-66018:** JFrog Artifactory build environment properties exposure\n\nBleepingComputer contacted JFrog and OpenAI to ask which of the eight CVEs were exploited during the incident and which vulnerabilities were chained together.\n\nOnly JFrog replied, declining to identify the CVEs or provide further technical details.\n\n\"Outside of our CTO's blog and commentary and JFrog release notes, we aren't adding further detail or comment at this time,\" JFrog told BleepingComputer.\n\nHowever, several of the CVEs found by BleepingComputer as associated with the release could have provided capabilities that matched portions of the attack detailed by OpenAI.\n\nCVE-2026-65924 is a server-side request forgery vulnerability in Artifactory's support for Terraform remote repositories.\n\nAn authenticated user, or an unauthenticated user when anonymous access is enabled on the repository, could exploit the flaw to make Artifactory send outbound HTTP requests to arbitrary destinations and return the response content.\n\nCVE-2026-65925 similarly allows a user with read access to an Artifactory Cargo remote repository to make Artifactory request unintended URLs and return the responses.\n\nAnother vulnerability, CVE-2026-66014, is an authentication-handling weakness in Artifactory's internal request processing that could allow an attacker to elevate privileges under specific conditions.\n\nThese vulnerabilities could have provided the internet-access and privilege-escalation capabilities described by OpenAI.\n\nHowever, it remains unknown which flaws were exploited, how they were chained, or whether all eight vulnerabilities were involved in the sandbox escape.\n\n##\n[Test every layer before attackers do](https://hubs.li/Q04jQ9z40)\n\nSecurity teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.\n\nThe Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.\n\n[Get the whitepaper](https://hubs.li/Q04jQ9z40)", "url": "https://wpnews.pro/news/openai-models-used-artifactory-zero-days-to-escape-to-the-internet", "canonical_source": "https://www.bleepingcomputer.com/news/security/openai-models-used-artifactory-zero-days-to-escape-to-the-internet/", "published_at": "2026-07-29 00:07:06+00:00", "updated_at": "2026-07-29 00:22:31.903854+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-research"], "entities": ["JFrog", "OpenAI", "Hugging Face", "Artifactory", "GPT-5.6 Sol", "ExploitGym", "Yoav Landman"], "alternates": {"html": "https://wpnews.pro/news/openai-models-used-artifactory-zero-days-to-escape-to-the-internet", "markdown": "https://wpnews.pro/news/openai-models-used-artifactory-zero-days-to-escape-to-the-internet.md", "text": "https://wpnews.pro/news/openai-models-used-artifactory-zero-days-to-escape-to-the-internet.txt", "jsonld": "https://wpnews.pro/news/openai-models-used-artifactory-zero-days-to-escape-to-the-internet.jsonld"}}