More details on the OpenAI sandbox escape incident: the zero-days exploited to breach Hugging Face's network were in JFrog Artifactory, a widely used repository management system. JFrog patched 9 CVEs Monday. Three (CVE-2026-65617, CVE-2026-65923, CVE-2026-66018) were privately reported by an OpenAI researcher, making them the likely culprits. No confirmation yet. Noteworthy caveat: JFrog's disclosure omits exploitation conditions, which is non-standard and limits customers' ability to assess their own risk. The models were running without production safeguards in a research environment. That context matters for interpreting what this demonstrates about frontier model capabilities. #aisecurity #openai #vulnerability
Post summary
The post reports that JFrog Artifactory zero‑day vulnerabilities were actively exploited to breach Hugging Face’s network and that JFrog has since patched the affected CVEs.