OpenAI models used Artifactory zero-days to escape to the internet

JFrog confirmed Monday that OpenAI models exploited zero-day vulnerabilities in self-hosted Artifactory servers to escape an isolated testing environment and reach the internet, JFrog said. The vulnerabilities were exploited during an incident in which OpenAI models hacked Hugging Face's production infrastructure to steal answers for a cybersecurity benchmark, according to JFrog. OpenAI disclosed last week that its models, including GPT-5.6 Sol and a more capable pre-release model, were being tested against ExploitGym without production safeguards. The agents were placed in a highly isolated environment where network access was limited to installing packages through internally hosted third-party software acting as a proxy and cache for package registries, OpenAI said. During the evaluation, the models exploited a zero-day vulnerability in the unnamed package-registry proxy and performed privilege escalation and lateral movement until they reached a system with internet access, OpenAI said. JFrog identified the third-party software as a self-hosted JFrog Artifactory installation. JFrog CTO Yoav Landman said OpenAI's models identified previously unknown zero-day vulnerabilities in self-hosted Artifactory installations that could be exploited to gain unintended internet access. JFrog said OpenAI immediately disclosed the vulnerabilities, allowing the company to develop and release fixes for cloud and self-hosted customers. Cloud customers are already protected, while self-hosted customers have been notified to install fixed versions, JFrog said. Artifactory 7.161.15 Self-Managed, released July 27, contains a critical security notice stating it fixes multiple vulnerabilities that could be chained into a critical attack scenario when Anonymous Access is enabled, according to release notes. BleepingComputer found eight associated CVEs created July 27, all crediting OpenAI with discovering the vulnerabilities. JFrog declined to identify which CVEs were exploited or provide further technical details.