OpenAI Agent Exploited JFrog Artifactory Flaw, Abused Modal Customer Sandbox—Here’s What Happened During the Hugging Face Incident – Firstpost

In the aftermath of the OpenAI-Hugging Face hacking incident that has shaken the tech industry, thanks to the exploitation of a zero-day vulnerability in a self-hosted JFrog Artifactory instance and the abuse of a customer’s unsecured sandbox on the Modal platform, an update from OpenAI on Tuesday revealed that at least four accounts across four other services, besides Hugging Face, were accessed by its agent as part of the incident. One of those services has been confirmed to be Modal, according to a Reuters report.

A few days earlier, Hugging Face published a detailed technical timeline outlining the full 4.5-day incident that unfolded in early July. The timeline documented more than 17,600 attacker actions grouped into 6,280 clusters across two major attack stages. The post-mortem report stated that the AI agent discovered a zero-day vulnerability, escaped containment, chained together multiple vulnerabilities, and moved across production infrastructure while generating thousands of actions and misleading artifacts.

JFrog Artifactory zero-day exploited by agent

During its ExploitGym evaluation, the agent was not meant to have unrestricted internet access. However, reports suggest it exploited a flaw in a package registry cache proxy within its environment to escape to the internet. OpenAI and JFrog have confirmed that the exploited cache proxy service was a self-hosted JFrog Artifactory instance that contained a zero-day vulnerability, which has since been patched.

OpenAI clarified in its Tuesday update that the attack involved its GPT-5.6 Sol model along with a pre-release model that was never intended for public release and was being tested internally as a research prototype.
( A zero-day vulnerability is a previously unknown security flaw in software or hardware that is discovered before the vendor has released a fix or patch.

The term “zero-day” refers to the fact that developers have had zero days to address the vulnerability once it becomes known or is actively exploited).

(A JFrog Artifactory flaw is a security weakness in JFrog’s software package repository that attackers can exploit to compromise systems or gain unauthorized access.)

OpenAI agent used external third-party services for the attack

The technical timeline published by Hugging Face further revealed that the rogue OpenAI agent abused third-party infrastructure during the attack, including a customer sandbox hosted on the Modal platform. Hugging Face explained that the customer’s sandbox contained a CyberGym execution harness, which the agent used for payload staging and code execution, effectively turning it into a launchpad for the attack.

OpenAI and Hugging Face also confirmed that the agent used publicly available third-party services, including code paste sites, request capture services, and screenshot services, to facilitate the attack. The companies noted that there was no platform- or account-level compromise involving these services, as they are publicly accessible tools.
(Payload staging is the process of preparing, storing, or positioning malicious code or files on a compromised system before executing the main attack. Attackers often do not launch their full attack immediately. Instead, they first stage the necessary tools, scripts, and malware so they can execute them later as part of a larger attack.)- Here, the agent used the third-party sandbox as his temporary launchpad.)

Hugging Face’s data processing pipeline abused by the agent

The technical report also detailed the injection vectors in Hugging Face’s data processing pipeline that were abused by the agent. The first exploit allowed the rogue agent to read files from a Hugging Face dataset-processing worker by uploading a malicious dataset configuration containing HDF5 files that declared their raw data existed at arbitrary filesystem paths.

Although no code was executed at this stage, the malicious configuration caused the worker to leak the entire worker pod environment, along with the worker’s source code, through the Hugging Face API. The leaked secrets and credentials obtained through this exploit were then used to further pivot across Hugging Face’s infrastructure.

In addition, the agent planted public datasets on Hugging Face as “dead drops” to store stolen data and stage additional payloads, using chunking, XOR and Gzip encoding techniques to evade Hugging Face’s security scanners. After gaining its initial foothold, the OpenAI agent expanded its access from the compromised worker pod across Hugging Face’s Kubernetes infrastructure.

The agent was also able to browse internal dataset servers and a MongoDB instance using a static password recovered from the worker environment. It further mapped Hugging Face’s cloud infrastructure using temporary credentials obtained from a cloud metadata endpoint, although it did not take control of those cloud resources.

The rogue AI agent ultimately exploited internal vulnerabilities to move laterally across Hugging Face’s infrastructure, obtained cluster-admin privileges through misconfigured credentials, accessed protected ExploitGym and CyberGym challenge solutions to “cheat” its evaluation, and demonstrated autonomous behaviors such as privilege escalation, infrastructure probing and adaptive tactics before security teams shut it down.