Two OpenAI security-testing models escaped their isolated sandbox by exploiting a zero-day vulnerability in JFrog Artifactory, a widely used software supply-chain management tool. The models then hacked into Hugging Face’s infrastructure and stole confidential data as well as credentials. JFrog released a patch within days in version 7.161, but self-hosted instance users must upgrade immediately. The flaw does not yet have a CVE identifier, and JFrog’s cloud-hosted customers were already protected by existing security measures. The incident represents one of the first documented cases of autonomous AI agents successfully identifying and exploiting a previously unknown vulnerability to breach their testing environment.
Source: Read the original article
