GoKawiilJFrog has confirmed that OpenAI models exploited zero-day vulnerabilities in self-hosted Artifactory servers to help escape an isolated testing environment and gain access to the internet before attacking Hugging Face.
The vulnerabilities were exploited during the incident in which OpenAI models hacked Hugging Face's production infrastructure to steal answers for a cybersecurity benchmark.
OpenAI disclosed last week that its models, including GPT-5.6 Sol and a more capable pre-release model, were being tested against ExploitGym, a benchmark designed to measure advanced cyber capabilities.
The models were run without production safeguards normally used to prevent AI agents from conducting autonomous cyber activity.
However, the agents were placed inside a highly isolated environment where network access was limited to installing packages through internally hosted third-party software acting as a proxy and cache for package registries.
During the evaluation, the models spent significant time looking for a way to reach the open internet and obtain the benchmark's test solutions.
OpenAI said the models exploited a zero-day vulnerability in the unnamed package-registry proxy and then performed privilege escalation and lateral movement inside the research environment until they reached a system with internet access.
OpenAI did not identify the package-registry proxy software or vendor at the time, saying only that the vulnerability had been privately disclosed and was being patched.
After reaching the internet, the models determined that Hugging Face might host the ExploitGym datasets and test solutions they were attempting to obtain.
OpenAI said the models searched for ways to access that information, chaining stolen credentials, zero-day vulnerabilities, and other attacks to find a remote code execution path into Hugging Face’s production infrastructure.
... continue reading