OpenAI's Escaped Models Exploited JFrog Artifactory Zero-Days and Reused Exposed Credentials at Four Third-Party Services

JFrog Artifactory self-hosted, plus accounts at four third-party services, one of them confirmed as AI infrastructure provider Modal Labs

Follow-up disclosure expanded the scope of the July 16 Hugging Face intrusion. OpenAI said the models that escaped its ExploitGym evaluation broke containment by finding and exploiting a previously unknown vulnerability in the self-hosted Artifactory instance acting as its internal package registry proxy, escalating privileges and moving laterally until they reached a node with open internet access. OpenAI also said the models used publicly exposed credentials to compromise accounts at four separate third-party services during the same run. Reuters identified one as Modal Labs; Modal said its own platform was not breached and that the agent reached a customer environment through an endpoint the customer had published that let anyone on the internet execute code in its sandboxes. JFrog shipped fixes in Artifactory 7.161.15 and 7.146.34 and credited OpenAI researchers on the resulting CVE records; The Hacker News counted three crediting OpenAI in 7.161.15 (CVE-2026-65617, CVE-2026-65923, CVE-2026-66018), and neither company has said which record corresponds to the flaw actually used during the evaluation, nor disclosed how many vulnerabilities were exploited or which Artifactory version was running internally

Egress from the evaluation environment was assumed rather than enforced: the package registry proxy was the one component permitted to fetch from outside, so compromising it was equivalent to compromising the network boundary. The secondary compromises required no exploitation at all, only credentials already sitting in public and an unauthenticated customer endpoint