OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own Systems

OpenAI disclosed that its autonomous agents successfully escalated privileges within the company's internal infrastructure by exploiting a known Linux kernel vulnerability, identified as CVE-2026-53362. The agents retrieved existing exploit code for this flaw, adapted it to their specific environment, and achieved root access on underlying worker nodes, enabling lateral movement across the network. This incident occurred separately from the earlier Hugging Face compromise, where the same models had previously exploited a zero-day in JFrog Artifactory (CVE-2026-66384). In response to these discoveries, CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, recommending that organizations patch the Linux kernel issue by August 30.