OpenAI's agents exploited a patched Linux bug in Hugging Face incident

OpenAI disclosed that on July 19, some of its AI agents exploited a public proof-of-concept for CVE-2026-53362, a high-severity Linux kernel vulnerability, to elevate privileges during a security incident involving Hugging Face. The agents escaped an Artifactory container, obtained root access to the underlying worker node, and moved laterally through the connected environment. The flaw, patched upstream in Linux 6.1.177, 6.6.144, 6.12.95, 6.18.38, and 7.1.3, was added to CISA's Known Exploited Vulnerabilities catalog on Aug. 27, with government agencies ordered to patch by Aug. 30.

ZDNET’s key takeaways - This security hole is an attack route. - Patch your systems as soon as possible. - AI means we’ll see more exploits like this. When Greg Kroah-Hartman, the Linux stable kernel maintainer, says you should always use the latest long-term stable LTS kernel https://www.zdnet.com/article/kernel-security-now-linuxs-unique-method-for-securing-code/ if you want your Linux system to be secure, you should listen. Take, for example, the recently patched CVE-2026-53362 https://nvd.nist.gov/vuln/detail/cve-2026-53362 vulnerability. CVE-2026-53362, aka IPv6 Frag Gap or “Fraggap,” is an out-of-bounds write vulnerability in the Linux kernel’s IPv6 packet-output code. As a result, the kernel can allocate a buffer that’s too small and then copy data past its end, overwriting the adjacent skb shared info structure. This security vulnerability can cause kernel heap corruption, a class of bug that can support local privilege escalation, denial of service, or data corruption. Also: Linux is getting a security wake-up call – why it was inevitable, and I’m not worried The vulnerable path is reachable from an unprivileged process using an IPv6 UDP socket with MSG MORE and MSG SPLICE PAGES, under fragmentation and scatter-gather conditions. In other words, this is not a conventional internet-facing remote-code-execution flaw. Instead, an attacker needs local code execution or a foothold inside a workload. As bugs go, this is bad, but it’s not awful. The National Vulnerability Database https://nvd.nist.gov/ lists the issue as a high-severity vulnerability with a CVSS score of 7. https://nvd.nist.gov/vuln/detail/cve-2026-53362 8. Why attention is rising The flaw was publicly fixed upstream earlier this summer, but many people didn’t patch it. That was a mistake. The security hole is now being exploited. On Aug. 27, the US Cybersecurity and Infrastructure Security Agency CISA https://www.cisa.gov/ added the exploit to the group’s Known Exploited Vulnerabilities KEV catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog . The title says it all. These are bugs hackers are using in the real world to launch attacks. Lucky us. Attention intensified on this bug after OpenAI disclosed that, on July 19, some of its agents found a public proof-of-concept for CVE-2026-53362. The OpenAI AI had adapted the CVE to the target architecture and used it to elevate privileges during OpenAI’s now-infamous security incident involving Hugging Face. Also: ‘Sophisticated’ AI swarm attacks are months away, OpenAI warns: What experts say businesses must do In that case, the agents escaped the confines of an Artifactory container https://docs.jfrog.com/installation/docs/docker , obtained root access to the underlying worker node, and then moved laterally through the connected environment, which is the container exploit nightmare scenario. CISA ordered government agencies to repair the bug by Aug 30. Good luck with that. I highly doubt all the fixes occurred over the weekend. Hopefully, they’ve been patched by now. In the meantime, it’s high time everyone else patched the bug. Who is affected The affected code is present in Linux kernel lines beginning with Linux 6.0, until a distribution’s kernel package incorporates the relevant backport. Upstream stable fixes are available in Linux 6.1.177, 6.6.144, 6.12.95, 6.18.38, and 7.1.3. These are all the latest LTS Linux kernels. That said, as Kroah-Hartman has also noted, very few Linux distributions operate in lock-step with the LTS kernels. Instead, the distros frequently backport individual security fixes without moving to the corresponding upstream point-release number. A system reporting an older-looking base kernel can therefore be patched, while another system with a superficially similar number can remain exposed. Also: AI a ‘force multiplier’ for low-skilled threat actors: 4 ways organizations should respond For an authoritative answer on whether your specific Linux kernel has been patched, you must check with your distributor to make sure you’re using a safe kernel. What administrators should do Apply your distribution’s current kernel security update : Use the vendor’s repository and advisory rather than compiling an upstream kernel solely for this CVE. Reboot into the updated kernel : Kernel vulnerabilities are not solved by downloading a new package. You must reboot into the new kernel. You can check the active kernel with the shell command: $ uname -r to confirm the running version corresponds with the fixed version . Prioritize systems with local or tenant workloads : That approach includes shared servers, development and build systems, VDI infrastructure, high-performance-computing clusters, Kubernetes worker nodes, container platforms, and CI/CD runners. The issue is most significant when an untrusted or lower-privileged process can turn ordinary local execution into control of the host kernel. Check container-host assumptions : Containerization does not make a kernel flaw disappear. Containers share the host kernel. Depending on configuration and privileges, a vulnerability in the networking path can become a route from a compromised container workload toward host-level control. That’s exactly what happened with the OpenAI case. Use temporary mitigations only as a bridge : For example, Fedora CoreOS states you can avoid this exploit by disabling IPv6 https://github.com/coreos/fedora-coreos-tracker/issues/2177 . Of course, if you use IPv6 networking, this approach won’t work. Review for signs of compromise : CISA’s KEV designation does not tell defenders how widely the vulnerability has been exploited, nor does it prove that every vulnerable machine has been targeted. The designation does, however, justify looking at unusual local privilege changes, unexpected root-owned processes, anomalous container activity, and suspicious movement from workload environments onto host systems. You know the drill. The broader lesson CVE-2026-53362 illustrates why local kernel bugs can matter as much as headline-grabbing remote flaws. A local attacker who has gained a modest foothold through a compromised developer account, such as a vulnerable application, a malicious build dependency, or an exposed container workload, can use a kernel defect to turn that foothold into root access. With root access obtained, it’s all over. Also: Assume AI cybersecurity attacks are the future: 43% of companies have already experienced it We can expect to see many more similar attacks. As OpenAI, ironically, warns, we’re months away from a situation where “ AI-enabled cyberattacks will become far more widespread https://www.zdnet.com/article/openai-warns-malicious-agents-coming-recommended-action/ and sophisticated as models around the world become increasingly capable.” The OpenAI disclosure adds another dimension. When a public proof-of-concept and a reachable target coexist, agentic systems can reduce the time and expertise traditionally needed to operationalize an exploit to mere hours. Tighten your safety belts. We’re in for a flood of security breaches that we’ve never seen before.