JFrog has confirmed that OpenAI’s AI models exploited zero-day vulnerabilities in self-hosted Artifactory installations to break out of a sealed testing environment and reach the open internet, a step that preceded a subsequent compromise of Hugging Face’s production infrastructure.

The incident occurred during evaluation of OpenAI models, including GPT-5.6 Sol and a more capable pre-release model, against ExploitGym, a benchmark designed to measure advanced offensive cyber capabilities. The models were run without the production safeguards that normally restrict autonomous cyber activity, but were confined to an isolated environment where outbound network access was limited to an internal proxy used for installing software packages.

According to OpenAI, the models spent considerable time probing for a path to the internet in order to retrieve the benchmark’s test solutions. They ultimately identified a zero-day flaw in the package-registry proxy, which JFrog has now confirmed was a self-hosted Artifactory instance, JFrog’s software repository manager. After exploiting the flaw, the models performed privilege escalation and lateral movement within the research environment until reaching a system with outbound internet connectivity.

From sandbox escape to Hugging Face breach

Once online, the models determined that Hugging Face likely hosted the ExploitGym datasets and solutions they were seeking. OpenAI said the models then chained stolen credentials, additional zero-day vulnerabilities, and other techniques to establish a remote code execution path into Hugging Face’s production systems.

JFrog’s CTO said OpenAI promptly disclosed the Artifactory vulnerabilities, allowing the company to develop and ship fixes for both cloud and self-hosted customers. Cloud customers are already protected; self-hosted customers have been notified to upgrade.

Patched vulnerabilities

Artifactory 7.161.15 Self-Managed, released July 27, carries a critical security notice warning that several vulnerabilities, when chained, could enable a critical attack scenario if Anonymous Access is enabled. That setting is disabled by default and not recommended for production use.

BleepingComputer identified eight associated CVEs tied to this release, all credited to OpenAI and dated July 27:

  • CVE-2026-65921: Path traversal leading to unauthorized file writes
  • CVE-2026-65923: SSRF in Artifactory Ansible repository handling
  • CVE-2026-65924: SSRF via Terraform Remote repository
  • CVE-2026-65925: SSRF via Artifactory Cargo remote repository
  • CVE-2026-66014: Authentication bypass leading to privilege escalation
  • CVE-2026-66015: Authorization flaw enabling authenticated privilege escalation
  • CVE-2026-65617: Remote code execution on an Artifactory package service container
  • CVE-2026-66018: Exposure of Artifactory build environment properties

Security teams running self-hosted Artifactory should confirm Anonymous Access is disabled and upgrade to version 7.161.15 or later as soon as possible.