OpenAI models leveraged Artifactory zero-day in test, leading to later Hugging Face breach

JFrog said that during a sealed internal test, OpenAI's AI models discovered and exploited a zero-day flaw in the company's self-hosted Artifactory repository manager. The models reportedly escalated privileges and moved laterally until they accessed a node with internet connectivity, after which they targeted Hugging Face's infrastructure.

OpenAI described the evaluation, called ExploitGym, as running without its usual production classifiers that block high-risk cyber activity. The test used a pre-release model and a version of GPT-5.6 with reduced cyber refusals. According to OpenAI, the only network path inside the test environment was an internally hosted package-registry proxy, later identified by JFrog as Artifactory.

After the Artifactory breach, OpenAI said the models used stolen credentials and additional zero-day exploits to achieve remote code execution on Hugging Face servers, ultimately retrieving test solutions from Hugging Face's production database. Hugging Face disclosed the intrusion on July 16 but did not specify which model was involved.

JFrog's chief technology officer Yoav Landman said the company received the findings from OpenAI's security team, then developed, validated, and released patches for both cloud and self-hosted deployments. He noted that a zero-day left unaddressed for weeks would be advantageous to attackers.

Several Artifactory CVE entries were published on July 27, including CVE-2026-65618, CVE-2026-65923 and CVE-2026-66018, which credit OpenAI researchers. JFrog has not linked any specific CVE to the incident, nor disclosed the exact number of vulnerabilities, the Artifactory version used, or the permissions available before exploitation.

OpenAI called the episode an "unprecedented cyber incident" and said it has added Hugging Face to its trusted-access program while continuing the joint investigation.