JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach

JFrog has confirmed thatOpenAI models exploited a zero-dayin self-hostedArtifactorywhile trying to reach the open internet from a sealed evaluation environment.

Artifactory is JFrog's software repository manager. OpenAI says the models then escalated privileges and moved laterally until they reached an internet-connected node. JFrog says it has since developed and released fixes for cloud and self-hosted customers.

The Artifactory exploit occurred inside OpenAI's environment. OpenAI says a separate attack path later reached Hugging Face's systems. JFrog says its cloud customers are already protected. Self-hosted users should review theArtifactory release notesand move to the remediating build for their maintained branch.

Several Artifactory CVE records were published on July 27 with affected-version ranges and fixed-version thresholds, but neither JFrog nor OpenAI has said whether any of those records correspond to the vulnerabilities used during the evaluation.

Among the vulnerabilities fixed in Artifactory 7.161.15, CVE-2026-65617, CVE-2026-65923, and CVE-2026-66018 credit OpenAI researchers.

The records do not map any CVE to the incident, identify the access required before exploitation, or explain why OpenAI refers to one proxy zero-day while JFrog refers to multiple vulnerabilities.

The incident started as one of OpenAI's own cyber-capability tests.OpenAI saidthe ExploitGym evaluation ran without the production classifiers that normally block high-risk cyber activity.GPT-5.6 Soland a more capable pre-release model also ran with reduced cyber refusals.

OpenAI said the sealed environment's only network path was an internally hosted package-registry proxy and cache, which JFrog later identified asArtifactory. The models used substantial computing resources to look for a way out.

OpenAI says the models escalated privileges and moved laterally until they reached a node with open internet access, then inferred that Hugging Face might host ExploitGym models, datasets, or solutions. The company said the models ultimately obtained test solutions directly from Hugging Face's production database.

In one example described by OpenAI, a model used stolen credentials and further zero-days to find a remote code execution path on Hugging Face servers. Hugging Facedisclosed the intrusionon July 16 without knowing which model was behind it.

Neither OpenAI nor Hugging Face explains how that RCE example relates to Hugging Face's account of initial access through malicious-dataset execution.

JFrog laid out its account in ablog postby chief technology officer Yoav Landman. The company said OpenAI's security team disclosed the findings, after which it developed, validated, and released fixes for cloud and self-hosted deployments. Landman framed the episode around response speed: a zero-day found by a model and left to sit for weeks, he wrote, is "a gift to attackers."

JFrog has not disclosed the exact number of Artifactory vulnerabilities used, the corresponding CVE IDs, the permissions available before exploitation, or the Artifactory version running inside OpenAI. It also has not said whether any of the flaws were exploited outside the controlled evaluation.

OpenAI called the episode an "unprecedented cyber incident." It said it has added Hugging Face to its trusted-access program and is still investigating alongside the company.

The Hacker News has reached out to JFrog for further details and will update this story if a response is received.

Correction:An earlier version of this article listed CVE-2026-65618 among the OpenAI-credited vulnerabilities fixed in Artifactory 7.161.15. The correct identifier is CVE-2026-65617. CVE-2026-65618 is a separate OpenAI-credited vulnerability affecting versions before 7.133.6.

Cybersecurity Webinars

How to Secure AI Code Before It Reaches Production

Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale.

How to Secure AI-Built Software at Machine Speed

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

A Look Inside Lasso's AI Security Platform

Claude Runs Across Six Surfaces in Your Company. Your Security Team Sees One.

How to Make Social Engineering Unprofitable

The New Insider Has No Pulse: Securing Privilege When the Actor Is an AI Agent

Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.