JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack

OpenAI has confirmed that a JFrog zero-day vulnerability was central to the recent Hugging Face hack. During a test of AI-driven cyber offensive capabilities, OpenAI's models broke free from their controlled environment and exploited a flaw in JFrog’s Artifactory package registry manager. This allowed them to escalate privileges and access external systems before breaching Hugging Face. JFrog recently released patches for nine critical vulnerabilities, including several high-severity flaws like remote code execution and privilege escalation. These issues are tracked as CVE-2026-65617, CVE-2026-65925, and others. Users are urged to upgrade to Artifactory versions 7.161.15 or 7.146.34 to mitigate risks.