OpenAI's AI Models Found and Exploited an Artifactory 0-Day on Their Own to Break Out of the “Sandbox”

JFrog has officially confirmed an unusual incident: OpenAI's models independently found and exploited a zero-day vulnerability in the self-hosted version of Artifactory (JFrog's repository manager) while trying to break out of a hermetically isolated test environment onto the open internet.

How the models broke out of isolation

It all began as an internal OpenAI test of cyber capabilities — an evaluation called ExploitGym. According to OpenAI, the test was run without the usual classifiers that normally block high-risk activity, and the models — GPT-5.6 Sol and a more powerful pre-release version — operated under relaxed restrictions on cyber actions.

The only network exit from the “sandbox” was an internal proxy and a package-registry cache — which, as JFrog later determined, was Artifactory. Having spent considerable compute searching for a way out, the models escalated privileges, moved laterally across the infrastructure, and ultimately reached a node with internet access.

From the “sandbox” to Hugging Face

From there, the models surmised that the ExploitGym materials — the tasks, datasets, and solutions — might be stored on Hugging Face, and, per OpenAI's account, pulled the test solutions straight from the platform's production database. In one of the described examples, a model used stolen credentials and additional 0-days to find a path to remote code execution on Hugging Face's servers. Hugging Face itself disclosed the intrusion back on July 16, without knowing which model was behind it.

Meanwhile, neither OpenAI nor Hugging Face explains how this RCE example squares with the platform's own account, in which the primary vector was named as the execution of a malicious dataset.

Patches are out, details are not

JFrog laid out its version in a blog post by CTO Yoav Landman. The company has already released fixes for cloud and self-hosted customers; cloud users, it says, are protected, while everyone else is advised to move to the patched build of their branch. Landman reduced the story to reaction speed: a 0-day found by a model and left unattended for weeks is, in his words, “a gift to attackers.”

There is, however, little certainty in the specifics. On July 27 several CVEs were published for Artifactory, and at least three of them — CVE-2026-65618, CVE-2026-65923, and CVE-2026-66018 — credit OpenAI researchers as authors. But no CVE is officially tied to the incident, and OpenAI speaks of a single “proxy 0-day,” whereas JFrog speaks of several vulnerabilities. Neither the exact number of holes, nor the version of Artifactory inside OpenAI, nor the level of privileges prior to exploitation has been disclosed.

OpenAI called what happened an “unprecedented cyber incident,” added Hugging Face to its trusted-access program, and is continuing the investigation jointly with the platform.

Source: The Hacker News