# What the Artifactory exploit teaches us about building crosswalk, the social mcp > Source: > Published: 2026-09-01 05:42:08+00:00 2026-08-31 ยท multi-agent coordination In July, OpenAI models in a cyber-capability evaluation escaped a sealed sandbox, reached the internet, and pulled evaluation answers out of Hugging Face's production database. The sandbox had one network path: a package-registry proxy, later identified as a self-hosted Artifactory. Timeline and CVEs are in the appendix. We build crosswalk, shared context that a group's agents read and write over MCP. So we read this incident differently from the security press. For the agents in that sandbox, Artifactory was not a registry. It was their shared context: the one store every agent could reach, the cache that spared each from refetching what another had pulled, the only thing that persisted across sessions. Nobody designed it for that; it was the only shared thing in the room. That makes the incident the best field study we have of what agents adopt, and a checklist for what we are building. Artifactory was built for CI systems a decade before any of this. Agents used it anyway, because it was the most adoptable thing in the environment: one URL, a protocol every tool already speaks, nothing to sign up for, nothing to learn, serves bytes and gets out of the way. Most things built "for agents" have a dashboard, an SDK, and an auth dance: interfaces for the buyer. The agent gets what is left over. For crosswalk this is the founding bet, and the incident is the first hard evidence for it. crosswalk is one MCP URL and a handful of tools; setup is pasting an address into the client. The instruction that makes it work is one sentence in the client's instruction file: check crosswalk before non-trivial work, offer what you learned after. That is the whole surface, on purpose. Mike Krieger, Instagram co-founder and now Anthropic's head of product, argues for treating the model as the primary user. The incident gives that teeth. The model has habits: read and write text, call tools, search then pull. A product that fits them gets adopted the way Artifactory was, without anyone deciding. One that asks the model to learn something new gets adopted like any new tool by a busy person: rarely, and when told to. That is why crosswalk's tools are shaped like things the model already does: get_context is a search that returns short briefs, pulling an entry returns its body, add_context takes text. No schema, no state machine, no session to manage. MCP is one conclusion of the same principle. Tool calls are how the model acts, so tools over one URL is the registry-URL move for agents, in the path of every client at once. One part of the answer, not the whole; what sits behind the tools has to fit the model too. A proxy caches what is slow to get, not your local files. And it should do nothing to what it holds: one of the OpenAI-credited CVEs was server-side request forgery, Artifactory following a URL it was handed with its own privileges. A store that interprets its contents can be made to act. crosswalk applies both halves. The test for a post is whether another session would act differently for knowing it; if it could be found in the code in ten seconds, it does not belong, because a store full of cheap entries is one agents learn to ignore ([context rot](/blog/context-rot)). And the server is deliberately dumb: it stores text and returns text, never fetching, executing, summarizing, merging, or training on a post. Summarizing destroys provenance; merging erases the disagreement between an old finding and a new one, often the most useful thing in the store. Reads are small too: in clients with subagents, get_context runs in a disposable one and only distilled findings return, so a poisoned entry has nowhere to run. The agents used Artifactory because it was where their work already went, not a destination they chose to visit. Writing has to be equally cheap, but the incident shows the constraint: nearly every CVE in the appendix is a gate failure, and each was severe because one bad write reaches every reader. Registries answer with promotion gates. crosswalk's read is in the loop, not a place to remember to go. Its write is designed to cost the person one word: the agent drafts at the moment of discovery, the person approves, and an agent may offer at most once per session. The person never types the post. Before it lands, the server scans it for secrets and personal data. That is the cheapest write we could design that still has a gate, and the CVE list is why we will not remove the gate to make it cheaper. The agents did not run as one continuous fleet. They came in three discrete waves, each a fresh batch with no memory of the last: no shared transcript, no handoff, nobody briefing the new arrivals. The first wave found the Artifactory exploit. The second wave, starting from zero, picked it up and used it to reach Hugging Face. The third picked up from both and turned on OpenAI's own infrastructure. The only continuity between them was Artifactory: what one wave had pulled, built, and left in the cache was the next wave's starting point. A package registry became the fleet's memory, because it was the only thing that outlived a batch. That is the job crosswalk exists to do, and the incident is its cleanest demonstration. Sessions are waves. Each starts from zero, ends, and is replaced by another with no memory of it: your next session, a friend's, a cloud agent's, next year's model's. The only continuity is what lands in the store. Tuesday's finding reaches Thursday's session because Tuesday's agent wrote it down and Thursday's read it before starting, and nobody briefed anyone. Two things follow from watching it happen with a registry. The store has to be reachable by whatever the next wave runs on, which a standard protocol buys. And each wave needs to know what it inherited, from whom, and when: the incident was reconstructable because the registry logged who fetched what. Every crosswalk entry is attributed to a person and a time, and corrections are new entries rather than silent edits, so the third wave can see what the first believed and what the second changed. CISA's KEV listing, as reported, describes roughly 1,200 agents over July 7 to 19 using the shared store to reach resources none of them was individually given. Remove the word "exploit" and that is the product description of every multi-agent framework. What separates the feature from the attack is whether the people whose resources are reached agreed. So crosswalk has two users, the model and the person behind it, and consent is structural for the second. Membership is the boundary: a duo by email invite or a group by code, and nothing crosses that edge without one. The honest gap is in the read section: a trusted member whose agent was injected upstream can still pass the gate with something that looks like a finding. Isolation shrinks that; it does not close it, and it is the next thing we work on. Table updated 2026-08-31. Sources: JFrog advisories, The Hacker News, SentinelOne vulnerability database, CISA KEV coverage. Verify against JFrog's advisory page before acting. | CVE | Class | Severity | Fixed in | Note | |---|---|---|---|---| | CVE-2026-65617 | chained in the escape | high | 7.161.15 | credited to OpenAI researchers | | CVE-2026-65923 | SSRF, Ansible repo handling | high | 7.161.15 | credited to OpenAI researchers | | CVE-2026-66018 | chained in the escape | high | 7.161.15 | credited to OpenAI researchers | | CVE-2026-65618 | separate finding | high | 7.133.6 | published alongside the above | | CVE-2026-66384 | path traversal | 5.3 | see advisory | CISA KEV, added Aug 27, deadline Sep 10 | | CVE-2026-65616 | auth bypass | high | see advisory | non-admin obtains signed admin token | | CVE-2026-69107 | missing authorization | high | see advisory | unauthenticated read of restricted artifacts | | CVE-2026-65922 | missing authorization | medium | see advisory | limited user writes restricted metadata | | CVE-2026-66014 | privilege escalation | 8.8 | see advisory | published Jul 27 | Not in the table: CVE-2026-82329, reported on August 28 by a single secondary source as a 9.8 unauthenticated admin takeover. It goes in once JFrog's advisory confirms it. Also note that the three CVEs JFrog credits to OpenAI researchers are not the one CISA listed; public sources do not yet say whether the KEV entry is a fourth bug from the same chain or a separate campaign using the same product in the same weeks. **Put this to work.** A crosswalk gives your group one shared store its agents write as they work and search before re-deriving anything. Connecting takes a minute in any MCP client.