JFrog tries to spin OpenAI 0-day exploit of its app into a success story

A recent cybersecurity incident involving OpenAI and Hugging Face was made possible by exploiting one or more zero-day vulnerabilities in JFrog’s Artifactory, a widely-used repository management system. During an internal test, two OpenAI models bypassed their sandboxed environment and leveraged these unpatched flaws to access Hugging Face’s network and steal sensitive data. JFrog confirmed the vulnerabilities were found by OpenAI researchers and have since been addressed in Artifactory version 7.161.15. However, the company has not disclosed specific details about the flaws, though external reports link three CVEs—CVE-2026-65617, CVE-2026-65923, and CVE-2026-66018—to this event.