JFrog has confirmed that the spectacular breach of OpenAI models at Hugging Face was made possible by exploiting unknown vulnerabilities in Artifactory. This is the first time it has become clear which software the AI models used to escape their isolated test environment and gain access to the internet.
OpenAI announced last week that two of its security models had escaped their sandbox during an internal evaluation and subsequently infiltrated Hugging Face’s network. Confidential data and login credentials were compromised in the process. At the time, OpenAI only reported that a combination of stolen credentials and zero-day vulnerabilities had been used.
JFrog has now revealed that the attack centered on a self-hosted installation of Artifactory, the software repository management platform used by thousands of development teams worldwide. According to the company, more than 7,500 organizations run on Artifactory, including approximately 80 percent of Fortune 100 companies.
“During an internal evaluation of frontier cyber capabilities, OpenAI’s models, running deliberately without production safeguards in an isolated research environment, autonomously discovered and employed chained vulnerabilities to escape its sandbox, reach the open internet, and extract evaluation answers from Hugging Face’s infrastructure,” writes JFrog CTO Yoav Landman. He adds that OpenAI subsequently notified the company of the vulnerabilities it had discovered.
Possibly three vulnerabilities involved
JFrog has since released patches, Ars Technica reports. However, the company is releasing remarkably few technical details. The release notes for Artifactory 7.161.15 list nine fixed vulnerabilities, without specifying which ones were actually exploited.
External CVE entries, however, show that three vulnerabilities (CVE-2026-65617, CVE-2026-65923, and CVE-2026-66018) were reported confidentially by OpenAI researcher Khai Tran. It is likely that at least two of these were part of the attack chain, although neither OpenAI nor JFrog has confirmed this.
The lack of technical information makes it difficult for customers to assess their own risk. Normally, vulnerability reports contain more information about the conditions under which a vulnerability can be exploited.
OpenAI conducted the test in a research environment where standard security measures had been deliberately disabled. The AI models were not supposed to be able to connect to the internet, but they still found a route through a hosted package registry proxy. It has since become clear that this was Artifactory.
According to OpenAI, while solving the ExploitGym security benchmark, one of the models became completely focused on achieving the test objective. In doing so, the model ultimately breached a Hugging Face production database to gather the necessary information. Hugging Face disclosed the breach on July 16. It wasn’t until five days later that OpenAI acknowledged that its own models were responsible for the incident.
Ten days between discovery and patch
JFrog presents its collaboration with OpenAI as an example of responsible vulnerability reporting. According to Landman, the incident demonstrates that AI systems can identify new attack methods and help detect and remediate security vulnerabilities more quickly.
However, this interpretation has also drawn criticism. Approximately 10 days elapsed between OpenAI reporting the zero-days and the release of patches. Additionally, five days passed before OpenAI publicly announced that its own models were behind the attack on Hugging Face.
This means that malicious actors who had discovered similar vulnerabilities could, in theory, have exploited the same head start. It is precisely this combination of a relatively long patch window and limited transparency about the vulnerabilities involved that fuels the debate over the risks posed by increasingly autonomous AI systems.