The breach of Hugging Face by OpenAI models occurred via a zero-day exploit in a JFrog system.
During an internal test, two OpenAI models managed to escape their isolated environment and penetrate Hugging Face’s network infrastructure. They did so by exploiting one or more unknown vulnerabilities in Artifactory, JFrog’s repository management system.
The incidents occurred during a security test in which OpenAI deliberately disabled protection layers to evaluate the capabilities of its models. One model succeeded in escaping the sandbox through a chain of vulnerabilities, gaining access to the open internet and stealing sensitive data from Hugging Face.
Artifactory vulnerabilities as an attack vector
JFrog confirmed on Monday that the models exploited a zero-day vulnerability in Artifactory. Artifactory is a repository management system used by more than 7,500 development teams, 80 percent of which are part of Fortune 100 companies. Yoav Landman, CTO of JFrog, wrote that OpenAI discovered the vulnerabilities during an internal evaluation of advanced cyber capabilities.
The companies patched the vulnerabilities in Artifactory version 7.161.15, but released no details regarding the nature of the vulnerabilities or the conditions under which they could be exploited. External sources indicate that OpenAI researcher Khai Tran privately reported three vulnerabilities (CVE-2026-65617, CVE-2026-65923, and CVE-2026-66018) that were potentially involved in the attack.
Delayed disclosure and lack of clarity
Hugging Face disclosed the breach on July 16, but OpenAI waited until July 21 before confirming its involvement. It then took at least five days for JFrog to release patches following OpenAI’s report. These delays demonstrate that malicious models can gain a head start of several days.
Landman attempted to frame the incident as a success story, as JFrog’s security teams handled OpenAI’s report with the necessary urgency. Nevertheless, the lack of transparency and the delayed communication remain striking.