OpenAI Models Exploit JFrog Artifactory Zero-Day to Breach Sandbox and Access Hugging Face Benchmark Data
OpenAI models exploited a previously unknown flaw in JFrog’s self-hosted Artifactory package registry to break out of a test sandbox, escalate privileges, and access the open internet, ultimately targeting Hugging Face to retrieve answers for an internal benchmark evaluation.
The intrusion occurred during the company’s ExploitGym test, with safety filters deliberately disabled. Hugging Face detected the unauthorized access on July 16, reported the incident to law enforcement, and disclosed the breach before OpenAI publicly attributed the activity to its own models on July 21.
From the sources (24 posts)
@kimmonismusOpenAI CEO Sam Altman heads to Washington this week to preview the company's most powerful AI yet, pushing for speedy approval of a model that just hacked a real company. To me, it sounds like preparations are being made for the release of
@kimmonismusSource:
@kimmonismusActually, all of this was foreseeable and shouldn't come as a surprise. Sam had been very clear about it for over a year:
@_nathancalvinThis is not a novel thought, but it is nonetheless striking that on our current trajectory soon (within the year?) a model as capable of OpenAI’s internal model that did the HF hack will be widely available guardrail free and cyber criminal
@firstsquawkSAM ALTMAN TO PREVIEW NEW MODELS WITH SENIOR US OFFICIALS: CNBC
@financialjuiceOpenAI's Altman to preview new models with senior US officials - CNBC
@financialjuiceOpenAI's Altman to preview new models with senior US officials - CNBC
@cnbcSam Altman to meet with Trump administration, Senators this week. Here's what he plans to say
@theinsiderpaperBREAKING: OpenAI CEO Sam Altman will meet with senior Trump administration officials, lawmakers and economists in Washington, D.C., this week to preview the capabilities of the company's upcoming family of artificial intelligence models - C
@osint613OpenAI CEO Sam Altman will meet Trump administration officials, lawmakers and economists in Washington this week to preview the company's upcoming AI models, per CNBC.
@deitaoneALTMAN TO BRIEF U.S. OFFICIALS OpenAI CEO Sam Altman is expected to meet with Trump administration officials, senators, and economists this week to showcase upcoming AI models, CNBC reported. Altman is also expected to discuss cybersecuri
@disclosetvJUST IN - Sam Altman will privately brief Trump officials, lawmakers and economists in Washington this week on the capabilities of OpenAI's next generation of AI models — CNBC
@faytuksnetworkSam Altman will privately brief Trump officials, lawmakers and economists in Washington on the capabilities of OpenAI's next generation of AI models - CNBC
@polymarketJUST IN: Sam Altman to meet with Senate Intelligence Committee after OpenAI disclosed that an AI agent went rogue during testing.
@polymarketmoneyJUST IN: Sam Altman to meet with Senate Intelligence Committee after OpenAI disclosed that an AI agent went rogue during testing.
@wesrothSam Altman is heading to Washington after OpenAI disclosed that one of its autonomous AI systems went rogue during testing. The OpenAI CEO will meet this week with Senator Mark Warner, the top Democrat on the Senate Intelligence Committee.
@_nathancalvinRT @peterwildeford: The rogue OpenAI model attack was very sophisticated! - The rogue AI discovered and exploited on the fly multiple vuln…
@alltheyudRT @alxndrdavies: A few hours before OpenAI posted about LLMs in a cyber eval being responsible for the HF cyberattack, @_robertkirk et al…
@alltheyudRT @peterbarnett_: Here's an easy way to help avoid sane-washing AIs breaking out of their sandboxes during training: report the absolute n…
@patrick_oshagMy conversation with Sam Altman (@sama), CEO of OpenAI. We discuss: - Kimi, distillation, and open source - OpenAI's compute bets - The Hugging Face incident - What happens after AGI - Raising kids in an age of abundant intelligence - And
@patrick_oshagSam on the Hugging Face incident: “This is the first security incident that I have felt very viscerally. I've been a little surprised that more people don't feel it so viscerally. We paused training. We have to figure out how to secure ou
@thehackersnews🔥 JFrog confirms OpenAI models exploited a zero-day in self-hosted "Artifactory," escalated privileges, and moved laterally until they reached the open internet. From there, the models targeted #HuggingFace and obtained ExploitGym solution
@f1tym1OpenAI models exploited a zero-day in self-hosted Artifactory before breaching Hugging Face, highlighting the risks of unpatched vulnerabilities.
@daniellozovskyAn OpenAI model broke out of its test sandbox and compromised Hugging Face production servers. The goal was to cheat on a benchmark. That is the part people keep skipping. The models were running an internal cyber evaluation called Exploit