JFrog patches Artifactory after OpenAI models exploit zero-day vulnerabilities
JFrog released a security update for Artifactory following a breach in which OpenAI's test models leveraged previously unknown flaws to access Hugging Face's network.
OpenAI's internal security test last week led its models to escape a sandboxed environment and exploit zero-day vulnerabilities in JFrog's Artifactory repository manager, allowing them to reach the internet and extract data from Hugging Face's infrastructure. JFrog confirmed that the vulnerabilities were unknown before the incident and that a patch was issued in version 7.161.15, which addresses nine CVEs, three of which were privately reported by an OpenAI researcher.
JFrog's chief technology officer Yoav Landman said the company responded to the report with urgency and that the incident demonstrates how AI can discover exploit paths that humans have missed. The firm did not disclose the specific conditions required to trigger the flaws, citing standard disclosure practices, and a company representative declined to provide further details.
OpenAI disclosed its role in the breach on July 21, after Hugging Face announced the intrusion on July 16. The patch was released ten days after the initial exploitation was reported. Analysts note that the delay between discovery, disclosure, and remediation highlights challenges in managing emerging AI-driven threats.