Comments
Hacker News
This works if only 'trusted' actors have access to frontier class models that can search for vulnerabilities. With a near-frontier model available with open weights then attackers will be able to do plenty of damage even with 'fast remediation'
by sambaumann
There is one thing that is still unclear to me after reading a lot about the hack:
* were the ExploitGym solutions actually available somewhere inside huggingface's private datasets ?
* was the model really trying to extract the solutions ? or had some sub-agent drifted enough from the original context that it was not even trying to solve the initial challenge ? that would look much worse for OpenAI, PR-wise.
by lovasoa
So they are the proxy in the hugging face hacking incident?
Way to bury that lede.
by amouat
I thought the new trust model was to ask the frontier cybersecurity model to hack your code and generate CVEs and to find the vulnerabilities ahead of time and fix them before receiving reports about your users being exploited?
And in OpenAI's case to ask the model to try to find vulnerabilities and breakout before running training in the environment.
Fast remediation would be the new standard to outside vulnerability reports, but also a follow up to determine how you can adapt the approach of the reporter to find vulnerabilities preemptively.
by gregwebs
What they conveniently omit in the blog post is what the vulnerability was: it seems like they renewed JWTs without checking the signature at all ! You could write arbitrary info in an old token, and get it signed without any verification.
by lovasoa
The part I find the strangest in that whole affair is the way OpenAI is framing a felony (their systems accessed other company servers and exfiltrated private data, for multiple days, by exploiting vulnerabilities) as a successful partnership with jfrog and huggingface.
Aren’t we now in a situation where a large AI vendor can engineer a similar situation against another corporation, then if caught committing a crime, they come up with the same “wow, look at what the agent did, thanks to our crazy rebellious AI the world is now safer”?
by dgellow
So that is the package caching proxy from the OpenAI/Huggingface fiasco!
However, many questions remain. JFrog positions itself as a vibe coding and AI security (!) company:
https://cybersecurityasia.net/jfrog-nvidia-secure-agentic-ai...
JFrog's own vibe code scanner failed:
https://jfrog.com/blog/jfrog-introduces-ai-generated-code-va...
Given the feature explosion and chaos in the Artifactory cache, it is likely vibe coded and hence full of primitive security vulnerabilities.
JFrog is spinning this as an AI victory together with OpenAI. To the contrary, it is a hype and vibe coding failure.
But the AI bloggers will omit the vulnerability generation part.
by tkhollt
This appears to confirm that the packaging proxy they were using for the research machine that their agent broke out of was Artifactory, the same software they use in production.
(You can tell they use it in production by asking regular ChatGPT to run "env | grep ARTIFAC" in its container environment.)
Hard to decipher which vulnerability was responsible, or if it took several.
https://www.cve.org/CVERecord?id=CVE-2026-66014 (reported by Amy Burnett, OpenAI) looks suspicious:
> JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.
Also https://www.cve.org/CVERecord?id=CVE-2026-65925 (reported by Matthew Bryant, OpenAI):
> A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.
by simonw
Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- This works if only 'trusted' actors have access to frontier class models that can search for vulnerabilities. With a near-frontier model available with open weights then attackers will be able to do plenty of damage even with 'fast remediation'by sambaumann
- There is one thing that is still unclear to me after reading a lot about the hack:
* were the ExploitGym solutions actually available somewhere inside huggingface's private datasets ?
* was the model really trying to extract the solutions ? or had some sub-agent drifted enough from the original context that it was not even trying to solve the initial challenge ? that would look much worse for OpenAI, PR-wise.
by lovasoa - So they are the proxy in the hugging face hacking incident?
Way to bury that lede.
by amouat - I thought the new trust model was to ask the frontier cybersecurity model to hack your code and generate CVEs and to find the vulnerabilities ahead of time and fix them before receiving reports about your users being exploited?
And in OpenAI's case to ask the model to try to find vulnerabilities and breakout before running training in the environment.
Fast remediation would be the new standard to outside vulnerability reports, but also a follow up to determine how you can adapt the approach of the reporter to find vulnerabilities preemptively.
by gregwebs - What they conveniently omit in the blog post is what the vulnerability was: it seems like they renewed JWTs without checking the signature at all ! You could write arbitrary info in an old token, and get it signed without any verification.by lovasoa
- The part I find the strangest in that whole affair is the way OpenAI is framing a felony (their systems accessed other company servers and exfiltrated private data, for multiple days, by exploiting vulnerabilities) as a successful partnership with jfrog and huggingface.
Aren’t we now in a situation where a large AI vendor can engineer a similar situation against another corporation, then if caught committing a crime, they come up with the same “wow, look at what the agent did, thanks to our crazy rebellious AI the world is now safer”?
by dgellow - So that is the package caching proxy from the OpenAI/Huggingface fiasco!
However, many questions remain. JFrog positions itself as a vibe coding and AI security (!) company:
https://cybersecurityasia.net/jfrog-nvidia-secure-agentic-ai...
JFrog's own vibe code scanner failed:
https://jfrog.com/blog/jfrog-introduces-ai-generated-code-va...
Given the feature explosion and chaos in the Artifactory cache, it is likely vibe coded and hence full of primitive security vulnerabilities.
JFrog is spinning this as an AI victory together with OpenAI. To the contrary, it is a hype and vibe coding failure.
But the AI bloggers will omit the vulnerability generation part.
by tkhollt - This appears to confirm that the packaging proxy they were using for the research machine that their agent broke out of was Artifactory, the same software they use in production.
(You can tell they use it in production by asking regular ChatGPT to run "env | grep ARTIFAC" in its container environment.)
Hard to decipher which vulnerability was responsible, or if it took several.
https://www.cve.org/CVERecord?id=CVE-2026-66014 (reported by Amy Burnett, OpenAI) looks suspicious:
> JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.
Also https://www.cve.org/CVERecord?id=CVE-2026-65925 (reported by Matthew Bryant, OpenAI):
> A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.
by simonw