3rd Party Risk Management
,
Artificial Intelligence & Machine Learning
,
Governance & Risk Management

Artifactory Bugs Helped Models Reach Hugging Face Production

Rashmi Ramesh (rashmiramesh_) •
July 30, 2026    

JFrog Patches Flaws Behind OpenAI Models' Escape
Image: Kurit Afshen/Shutterstock

Software supply-chain firm JFrog says a zero-day exploited by two OpenAI models to burst from their testing environment and into Hugging Face’s production system was a flaw in its Artifactory repository manager.

See Also: Why an AI Harness May Matter More Than the Latest Model

JFrog shipped patches on Monday, days after the breach became public. JFrog CTO Yoav Landman wrote in a blog post that OpenAI’s models identified vulnerabilities in self-hosted Artifactory installations that could be exploited to gain internet access. The models found the flaws during an internal security evaluation. Landman said OpenAI disclosed the issue right away.

Artifactory stores and distributes software components. JFrog says the repository software is run by more than 7,500 DevOps teams and is used by 80% of Fortune 100 companies.

OpenAI disclosed earlier this month that its GPT-5.6 Sol and an unnamed pre-release model were being tested on ExploitGym, a benchmark for cyber capability. OpenAI ran the test without its usual production safeguards, so the models could act with no limits on cyberattacks. Their only network path ran through an internal package registry proxy. The models spent significant computing power probing the proxy until they found a way through it (see: When the Sandbox Won’t Hold: Lessons From Hugging Face).

Once past the proxy, the models escalated privileges and moved through OpenAI’s own network until they reached a system with internet access. From there, they inferred that Hugging Face likely held the datasets or answer keys tied to ExploitGym. They chained stolen credentials with the Artifactory flaws to find a path into Hugging Face’s production servers, then pulled evaluation answers straight from a production database.

Hugging Face’s own security team caught and contained the activity before OpenAI’s team made contact, OpenAI said. OpenAI has since added Hugging Face to its Trusted Access for Cyber program, giving Hugging Face’s engineers direct use of OpenAI’s models for defensive work. JFrog released a fixed version, Artifactory 7.161.15. Cloud customers are protected automatically, while self-hosted users were told to upgrade.

A Tuesday update in an OpenAI blog post detailing the incident widened the picture. The models also used exposed credentials to reach four accounts across four other public services connected to the Hugging Face incident. One account was used to send data, another to store it and two were only viewed. OpenAI said it found no evidence of broader impact on those services.

It is unclear how many vulnerabilities were involved. JFrog’s release notes for version 7.161.15 list nine fixed vulnerabilities without saying which ones the models used. Public CVE records show three of them, CVE-2026-65617, CVE-2026-65923 and CVE-2026-66018, which were reported confidentially by an OpenAI researcher. OpenAI’s own blog still refers only to “a zero-day,” in the singular.

Hugging Face co-founder and CEO Clem Delangue framed the episode as proof of an argument he has made before. “Artificial intelligence safety won’t be solved by any single company working in secret,” Delangue said in OpenAI’s blog post. “It will be solved in the open, collaboratively, with broad access to AI for every defender, everywhere.”

OpenAI said it is working with CrowdStrike to confirm what the models did in its own network and Hugging Face’s. It has also brought in Metr and Redwood Research for an independent review of the models’ behavior, which will feed a technical report due once OpenAI’s internal investigation, overseen by its safety and security committee, is complete.

Both companies frame the episode as proof that AI models capable of finding one zero-day could help defenders find and fix others faster than attackers can. Outside researchers see a different lesson in the same facts. The failure point was not a sophisticated exploit but a package proxy widely treated as low-risk internal plumbing. As one independent security analysis put it, sandboxed evaluation stops working as a safety guarantee once an AI agent can reason its way through containment the way a human attacker would.