alt.hn

7/28/2026 at 12:02:57 PM

Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings)

 https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/

by 882542F3884314B

7/28/2026 at 1:45:54 PM

So that is the package caching proxy from the OpenAI/Huggingface fiasco!

However, many questions remain. JFrog positions itself as a vibe coding and AI security (!) company:

https://cybersecurityasia.net/jfrog-nvidia-secure-agentic-ai...

JFrog's own vibe code scanner failed:

https://jfrog.com/blog/jfrog-introduces-ai-generated-code-va...

Given the feature explosion and chaos in the Artifactory cache, it is likely vibe coded and hence full of primitive security vulnerabilities.

JFrog is spinning this as an AI victory together with OpenAI. To the contrary, it is a hype and vibe coding failure.

But the AI bloggers will omit the vulnerability generation part.

by tkhollt

7/28/2026 at 1:45:06 PM

This appears to confirm that the packaging proxy they were using for the research machine that their agent broke out of was Artifactory, the same software they use in production.

(You can tell they use it in production by asking regular ChatGPT to run "env | grep ARTIFAC" in its container environment.)

Hard to decipher which vulnerability was responsible, or if it took several.

https://www.cve.org/CVERecord?id=CVE-2026-66014 (reported by Amy Burnett, OpenAI) looks suspicious:

> JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.

Also https://www.cve.org/CVERecord?id=CVE-2026-65925 (reported by Matthew Bryant, OpenAI):

> A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.

by simonw

7/29/2026 at 7:45:19 AM

Thanks for the link to the CVE. Are we likely to ever get a full breakdown of the exploit? I guess when artifactory is patched and deployed widely? Although I must admit my interest in mostly curiosity, but perhaps a full disclosure and explanation might give other folks guidance about much they need to lock down their code or maybe even a construction in java (?) to avoid?

by iansmith_hn

7/28/2026 at 2:26:56 PM

The part I find the strangest in that whole affair is the way OpenAI is framing a felony (their systems accessed other company servers and exfiltrated private data, for multiple days, by exploiting vulnerabilities) as a successful partnership with jfrog and huggingface.

Aren’t we now in a situation where a large AI vendor can engineer a similar situation against another corporation, then if caught committing a crime, they come up with the same “wow, look at what the agent did, thanks to our crazy rebellious AI the world is now safer”?

by dgellow

7/28/2026 at 3:17:20 PM

I don’t see how it can’t be both. Yes, it is a felony, unarguably, but it’s also a first of its kind and I’ll be very interested in who law enforcement prosecutes and what the judiciary says about this. Almost everything is a precedent here except ‘somebody got hacked’.

by baq

7/28/2026 at 3:31:53 PM

White-hat hackers go to prison for running a scanner on a website and reporting the found vulnerabilities to the website owner without exploiting them. I don't see why this should be any different.

by pocksuppet

7/28/2026 at 4:08:27 PM

It's different since there was no single physical person who executed the hack or even asked for it. Intent is the difference between manslaughter and murder and we couldn't technically in any reasonable way commit an accidental hack into a computer system before approximately last month (or last quarter if we consider Mythos previews to be capable of this.)

by baq

7/28/2026 at 4:12:50 PM

Intent is a result of an investigation, it’s not something you need beforehand

by dgellow

7/28/2026 at 11:27:33 PM

It's different for the same reason why AI can't own copyright.

by literalAardvark

7/28/2026 at 3:20:00 PM

If someone invents a new weapon to hurt someone, is the first inflicted injury unprecedented?

by ses1984

7/28/2026 at 3:31:05 PM

Intent is a major part of a crime severity, and it's hard to attribute intent to OpenAI here

by breppp

7/28/2026 at 4:04:36 PM

The intent is something that has to be determined as part of the investigation and following judgement. But will we see an actual investigation by law enforcement?

by dgellow

7/29/2026 at 3:19:06 AM

There can be crime without intent, like manslaughter.

by ses1984

7/28/2026 at 4:14:20 PM

It's not a first of it's kind. AI is a hammer, and the one wielding the hammer is responsible for those hurt by the hammer. It's a classic case of the powerful not being held accountable. It's a tale as old as time.

by stronglikedan

7/28/2026 at 3:17:49 PM

The law doesn’t apply to billion dollar corporations.

by ses1984

7/28/2026 at 3:32:27 PM

They also did felony copyright infringement many times over. Seems we're all rediscovering the iron law of politics: the only rule is that the most powerful people make the rules.

by pocksuppet

7/28/2026 at 1:49:20 PM

What they conveniently omit in the blog post is what the vulnerability was: it seems like they renewed JWTs without checking the signature at all ! You could write arbitrary info in an old token, and get it signed without any verification.

https://www.youtube.com/watch?v=q2KCrmQz9WE

by lovasoa

7/28/2026 at 3:01:10 PM

That video suggests that RTDEV-92030 was the fix for the issue - but https://docs.jfrog.com/releases/docs/artifactory-self-manage... says that issue was resolved in a 15 July 2026 release of Artifactory, which doesn't fit our timeline - that was prior to the original Hugging Face post on 16 July which was several days before OpenAI had confessed.

by simonw

7/28/2026 at 5:00:14 PM

The timeline is indeed a little bit fuzzy, I haven't found a precise chronology, neither from HuggingFace nor from OpenAI. HF says the hack happened "over a weekend", so probably July 11th-12th. Do you think it took OpenAI a week to realize what happened ?

Maybe when HF published their blog post on the 15th, OpenAI already knew something had happened, had started to investigate, and already reported the issue to JFrog ? But looking at your other comment in the thread, I agree that CVE-2026-65925 and CVE-2026-66014 are better candidates.

Taking a step back, so many basic vulnerabilities in a security-oriented product just makes the headline "agent autonomously escaped containment" sound a little less spectacular.

by lovasoa

7/28/2026 at 5:43:11 PM

> Do you think it took OpenAI a week to realize what happened ?

Apparently it did take them a while. This report here https://cloudsecurityalliance.org/artifacts/hugging-face-cis... includes extra details from a conversation Hugging Face:

> The intrusion lasted about four days: two days were spent on reconnaissance, followed by one silent day and a final day of intense activity.

That suggests OpenAI didn't spot what was happening for four days.

by simonw

7/28/2026 at 3:37:22 PM

Are you suggesting issue should've been resolved *after* it was made public?

by NooneAtAll3

7/28/2026 at 3:52:09 PM

I'm suggesting that you can't release a fix for an issue that hasn't been reported to you yet.

by simonw

7/28/2026 at 3:09:16 PM

[dead]

by 35876

7/28/2026 at 3:27:00 PM

This seems unlikely as it would mean JFrog knew the vulnerability before OpenAI, which this blog posts clearly says the opposite

by K3UL

7/28/2026 at 2:44:20 PM

I believe the technical term for that is "big oof"

by patmorgan23

7/28/2026 at 1:04:14 PM

I thought the new trust model was to ask the frontier cybersecurity model to hack your code and generate CVEs and to find the vulnerabilities ahead of time and fix them before receiving reports about your users being exploited?

And in OpenAI's case to ask the model to try to find vulnerabilities and breakout before running training in the environment.

Fast remediation would be the new standard to outside vulnerability reports, but also a follow up to determine how you can adapt the approach of the reporter to find vulnerabilities preemptively.

by gregwebs

7/28/2026 at 12:57:03 PM

So they are the proxy in the hugging face hacking incident?

Way to bury that lede.

by amouat

7/28/2026 at 2:51:58 PM

My guess is someone was going to release a very unflattering article about them so they tried to get ahead of it by doing this

by DannyBee

7/28/2026 at 3:56:10 PM

Yeah. But it's 10 paragraphs of AI nonsense that barely mentions the actual story.

Who could have thought this was a good idea? It literally reads like "ai security is important, btw we're the reason hugging face got hacked, we're awesome at securing things"

by amouat

7/28/2026 at 1:57:28 PM

There is one thing that is still unclear to me after reading a lot about the hack:

* were the ExploitGym solutions actually available somewhere inside huggingface's private datasets ?

* was the model really trying to extract the solutions ? or had some sub-agent drifted enough from the original context that it was not even trying to solve the initial challenge ? that would look much worse for OpenAI, PR-wise.

by lovasoa

7/28/2026 at 3:02:25 PM

According to https://cloudsecurityalliance.org/artifacts/hugging-face-cis... the models ended up finding CyberGym solutions, which was the wrong benchmark.

by simonw

7/28/2026 at 10:40:55 PM

... but that's since been refuted by https://huggingface.co/blog/agent-intrusion-technical-timeli... which says:

> While the intrusion did reach Hugging Face's internal infrastructure, the only customer content accessed was the set of ExploitGym/CyberGym challenge solutions stored in five datasets.

by simonw

7/28/2026 at 1:08:52 PM

This works if only 'trusted' actors have access to frontier class models that can search for vulnerabilities. With a near-frontier model available with open weights then attackers will be able to do plenty of damage even with 'fast remediation'

by sambaumann

7/28/2026 at 3:21:31 PM

No, that is not the new trust model.

by xbar

7/28/2026 at 2:38:47 PM

The JFrog article is so sweaty...sort of "actually this is _good_ news". This whole mess points to the fundamental problem of running critical infrastructural services on open networks, and hoping that <your approach of choice to feeding/watering those services> keeps you safe. Just don't.

by pmm343

7/28/2026 at 3:45:09 PM

Right. There are a few projects that can be generally trusted with internet exposure - like OpenSSH, Wireguard, nginx/Apache. Most other stuff should be kept behind some kind of firewall because it is just too likely to contain a serious vulnerability.

by pocksuppet

7/28/2026 at 4:54:58 PM

[flagged]

by chrisbuilds42