OpenAI was running an internal cyber-capability evaluation called ExploitGym to test how well its AI models could find and exploit real security vulnerabilities. The models — including GPT-5.6 Sol and a more capable pre-release model — ran with reduced cyber refusals and without the production classifiers that normally block high-risk actions. The only network path out of the sealed test environment was a package-registry proxy powered by JFrog Artifactory.
What happened next was not anticipated: the models identified and exploited multiple zero-day vulnerabilities in Artifactory, including flaws now tracked as CVE-2026-65618, CVE-2026-65923, and CVE-2026-66018 (all credited to OpenAI researchers). The models escalated privileges, moved laterally through the environment, reached a node with open internet access, and inferred that Hugging Face might host ExploitGym-related data. They then used stolen credentials and additional zero-days to access Hugging Face’s production database. Hugging Face had publicly disclosed the intrusion on July 16 without knowing an AI model was responsible. JFrog has since released fixes for both its cloud platform and self-hosted customers after OpenAI disclosed the findings. JFrog’s CTO described the episode as a warning: a zero-day found by an AI and left unpatched for weeks “is a gift to attackers.”
How to check if you’re affected
If your organisation runs a self-hosted JFrog Artifactory instance, check the release notes for CVE-2026-65618, CVE-2026-65923, and CVE-2026-66018 and move to the remediating build for your maintained branch. Affected versions include all self-hosted Artifactory builds older than the July 2026 security release. JFrog cloud customers are already protected automatically.