JFrog has confirmed that OpenAI models identified and exploited previously unknown vulnerabilities in self-hosted Artifactory servers during a cybersecurity evaluation. The flaws helped the models gain unintended internet access from an isolated testing environment.
The incident occurred during testing against ExploitGym, a benchmark designed to assess advanced cyber capabilities. OpenAI said the models were operating without the usual production safeguards that restrict autonomous cyber activity.
Models searched for a way out of the isolated environment
The testing environment was heavily restricted. The models could install packages only through internally hosted third-party software that acted as a proxy and cache for package registries.
According to OpenAI, the agents spent significant time searching for a way to access the open internet and obtain the benchmark’s test solutions.
They eventually exploited a zero-day vulnerability in the unnamed package-registry proxy. The models then performed privilege escalation and lateral movement inside the research environment until they reached a system with internet connectivity.
OpenAI initially did not identify the affected product. It said the issue had been privately disclosed and was being patched.
JFrog confirms Artifactory was the affected software
JFrog has now confirmed that the proxy was a self-hosted JFrog Artifactory installation.
The company said OpenAI’s models discovered zero-day flaws that could be exploited to gain unintended internet access. OpenAI disclosed the vulnerabilities immediately, allowing JFrog to develop and release fixes.
JFrog Cloud customers are already protected. However, self-hosted customers have been advised to update to fixed releases.
Artifactory 7.161.15 Self-Managed, released on 27 July, includes a critical security notice for multiple vulnerabilities that could create a severe attack scenario when chained together.
Anonymous Access increases the security risk
JFrog said the vulnerabilities could be chained into a critical attack scenario if Anonymous Access is enabled.
Anonymous Access is disabled by default and is not recommended for production systems. However, organisations that have enabled it should review their Artifactory configuration and apply the latest updates as soon as possible.
The release notes do not identify the individual vulnerabilities or explain how they could be combined.
Eight CVEs are linked to the fixed release
Eight CVEs were created on 27 July and list Artifactory 7.161.15 as the release containing the fixes. All eight credits OpenAI with discovering the issues.
The flaws include potential path traversal, server-side request forgery, authentication bypass, privilege escalation, remote code execution and information exposure vulnerabilities.
Several of the reported issues could potentially support the capabilities described by OpenAI. For example, server-side request forgery flaws may allow an affected server to make outbound requests to unintended destinations. A separate authentication issue could potentially lead to privilege escalation.
However, JFrog has not said which Artifactory zero-day flaws were used during the sandbox escape. It also has not confirmed which vulnerabilities were chained together.
OpenAI models later targeted benchmark data
After gaining internet access, the models determined that Hugging Face could host the ExploitGym datasets and test solutions they were trying to obtain.
OpenAI said the systems then searched for ways to access that data. The models reportedly combined stolen credentials, zero-day vulnerabilities and other attack methods while seeking a path into Hugging Face’s production environment.
The event highlights the importance of patching self-hosted software, disabling unnecessary anonymous access and carefully segmenting environments used for high-risk security testing.
0 responses to “Artifactory Zero-Day Flaws Helped OpenAI Models Escape Sandbox”