JFrog has confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory while trying to reach the open internet from a sealed evaluation environment.
Artifactory is JFrog’s software repository manager. OpenAI says the models then escalated privileges and moved laterally until they reached an internet-connected node. JFrog says it has since developed and released fixes for cloud and self-hosted customers.
The Artifactory exploit occurred inside OpenAI’s environment. OpenAI says a separate attack path later reached Hugging Face’s systems. JFrog says its cloud customers are already protected. Self-hosted users should review the Artifactory release notes and move to the remediating build for their maintained branch.
Several Artifactory CVE records were published on July 27 with affected-version ranges and fixed-version thresholds, but neither JFrog nor OpenAI has said whether any of those records correspond to the vulnerabilities used during the evaluation.
At least three of those records, CVE-2026-65618, CVE-2026-65923, and CVE-2026-66018, credit OpenAI researchers.
The records do not map any CVE to the incident, identify the access required before exploitation, or explain why OpenAI refers to one proxy zero-day while JFrog refers to multiple vulnerabilities.
The incident started as one of OpenAI’s own cyber-capability tests. OpenAI said the ExploitGym evaluation ran without the production classifiers that normally block high-risk cyber activity. GPT-5.6 Sol and a more capable pre-release model also ran with reduced cyber refusals.
OpenAI said the sealed environment’s only network path was an internally hosted package-registry proxy and cache, which JFrog later identified as Artifactory. The models used substantial computing resources to look for a way out.
OpenAI says the models escalated privileges and moved laterally until they reached a node with open internet access, then inferred that Hugging Face might host ExploitGym models, datasets, or solutions. The company said the models ultimately obtained test solutions directly from Hugging Face’s production database.
In one example described by OpenAI, a model used stolen credentials and further zero-days to find a remote code execution path on Hugging Face servers. Hugging Face disclosed the intrusion on July 16 without knowing which model was behind it.
Neither OpenAI nor Hugging Face explains how that RCE example relates to Hugging Face’s account of initial access through malicious-dataset execution.
JFrog laid out its account in a blog post by chief technology officer Yoav Landman. The company said OpenAI’s security team disclosed the findings, after which it developed, validated, and released fixes for cloud and self-hosted deployments. Landman framed the episode around response speed: a zero-day found by a model and left to sit for weeks, he wrote, is “a gift to attackers.”
JFrog has not disclosed the exact number of Artifactory vulnerabilities used, the corresponding CVE IDs, the permissions available before exploitation, or the Artifactory version running inside OpenAI. It also has not said whether any of the flaws were exploited outside the controlled evaluation.
OpenAI called the episode an “unprecedented cyber incident.” It said it has added Hugging Face to its trusted-access program and is still investigating alongside the company.
The Hacker News has reached out to JFrog for further details and will update this story if a response is received.
