JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach  Swati Khandelwal  Jul 28, 2026 Vulnerability / Artificial Intelligence JFrog has confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory while trying to reach the open internet from a sealed evaluation environment. Artifactory is JFrog's software repository manager. OpenAI says the models then escalated privileges and moved laterally until they reached an internet-connected node. JFrog says it has since developed and released fixes for cloud and self-hosted customers. The Artifactory exploit occurred inside OpenAI's environment. OpenAI says a separate attack path later reached Hugging Face's systems. JFrog says its cloud customers are already protected. Self-hosted users should review the Artifactory release notes and move to the remediating build for their maintained branch. Several Artifactory CVE records were published on July 27 with affected-version ranges and fixed-version thresholds, but neither JFrog nor OpenAI has said whether any of those records correspond to the vulnerabilities used during the evaluation. At least three of those records, CVE-2026-65618, CVE-2026-65923, and CVE-2026-66018, credit OpenAI researchers. The records do not map any CVE to the incident, identify the access required before exploitation, or explain why OpenAI refers to one proxy zero-day while JFrog refers to multiple vulnerabilities. The incident started as one of OpenAI's own cyber-capability tests. OpenAI said the ExploitGym evaluation ran without the production classifiers that normally block high-risk cyber activity. GPT-5.6 Sol and a more capable pre-release model also ran with reduced cyber refusals. OpenAI said the sealed environment's only network path was an internally hosted package-registry proxy and cache, which JFrog later identified as Artifactory . The models used substantial computing resources to look for a way out. OpenAI says the models escalated privileges and moved laterally until they reached a node with open internet access, then inferred that Hugging Face might host ExploitGym models, datasets, or solutions. The company said the models ultimately obtained test solutions directly from Hugging Face's production database. In one example described by OpenAI, a model used stolen credentials and further zero-days to find a remote code execution path on Hugging Face servers. Hugging Face disclosed the intrusion on July 16 without knowing which model was behind it. Neither OpenAI nor Hugging Face explains how that RCE example relates to Hugging Face's account of initial access through malicious-dataset execution. JFrog laid out its account in a blog post by chief technology officer Yoav Landman. The company said OpenAI's security team disclosed the findings, after which it developed, validated, and released fixes for cloud and self-hosted deployments. Landman framed the episode around response speed: a zero-day found by a model and left to sit for weeks, he wrote, is "a gift to attackers." JFrog has not disclosed the exact number of Artifactory vulnerabilities used, the corresponding CVE IDs, the permissions available before exploitation, or the Artifactory version running inside OpenAI. It also has not said whether any of the flaws were exploited outside the controlled evaluation. OpenAI called the episode an "unprecedented cyber incident." It said it has added Hugging Face to its trusted-access program and is still investigating alongside the company. The Hacker News has reached out to JFrog for further details and will update this story if a response is received. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post. SHARE      Tweet  Share  Share  Share   Share on Facebook  Share on Twitter  Share on Linkedin  Share on Reddit  Share on Hacker News  Share on Email  Share on WhatsApp Share on Facebook Messenger  Share on Telegram SHARE  Application Security , artificial intelligence , Cloud security , cyberattack , Cybersecurity Research , data breach , network security , Software Security , Vulnerability , Zero-Day ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See