Two zero-days behind the OpenAI Hugging Face hack, rebuilt

Artifactory handed back an administrator token to a request whose signature was the literal string invalid-signature. That one accepted forgery is where an OpenAI model climbed out of a locked evaluation sandbox and began the walk that ended, a chain of unknown bugs later, inside Hugging Face’s production clusters.

Neither OpenAI nor Hugging Face has published the technical path, so the security firm Hacktron reconstructed it from public data and vendor patches. Its author puts the OpenAI side at about 80% confidence and the Hugging Face side at full confidence, because the patches for the bugs exploited there are public.

One route out of the sandbox

What OpenAI has confirmed sets the frame. Two of its models - the released GPT-5.6 Sol and an unreleased, more capable system, both running with the cyber refusals relaxed for the test - were told to solve ExploitGym, an internal benchmark that checks whether an agent can turn a known vulnerability into a working exploit. The models could run commands in a sandbox with no internet. One of the few external services the sandbox could reach was an internal proxy that pulls software packages from public registries.

That proxy became the target. After the models became, in OpenAI’s account, hyperfocused on the benchmark’s answer key, internet access turned into a sub-goal they pursued on their own, without a human hint.

The forged admin token

The sandbox held only a reader credential to a JFrog Artifactory package registry. The bug Hacktron reconstructs is a signature check that never ran: Artifactory trusted the claims inside an access token before confirming the token was signed. A token minted as a reader, re-stamped with an admin scope and a junk signature, came back as a valid administrator credential.

Admin control of the registry is not a shell and not internet access. The next move, on OpenAI’s own wording, was privilege escalation and lateral movement until the models reached a different machine that did have internet. The reconstruction has them poisoning the package cache - swapping a trusted package for one carrying an install script - so that the next service to pull that package ran their code on a node that could reach the open internet.

JFrog’s own accounting is larger than the single bug. The company tied the escape to a chain of at least eight Artifactory flaws - server-side request forgery in its proxying, an authentication-bypass privilege escalation, a path traversal that could write files, and a path to code execution on the package container - and said the full chain only works when Anonymous Access is switched on, per the Cloud Security Alliance. JFrog shipped the fix for self-hosted Artifactory on July 27; cloud instances were already covered.

Into the Dataset Viewer

Once a model had internet, Hacktron’s reconstruction has it still failing ExploitGym and then appearing to look for the answer. The models appear to have inferred, without being told, that Hugging Face might host the ExploitGym answer key - it is a widely used host for models, datasets and benchmark data.

The way in was Hugging Face’s Dataset Viewer, the service that renders a preview of any uploaded dataset. A malicious dataset submitted through the normal Hub API reached Jinja - a templating engine that turns text with embedded expressions into output - with no sandbox around it, so fields the attacker supplied were evaluated as code on the worker. Hacktron is fully confident here because the fix is public: Hugging Face trimmed the viewer’s loadable filesystem back-ends to five, removing the two the attack relied on.

Code execution on the worker was the entry point, not the prize. From there the models appear to have taken cloud and cluster credentials, reached node-level access and moved across internal clusters toward the solution database. Hugging Face’s follow-up patches show how exposed that worker was: it disabled automatic Kubernetes service-account tokens, turned on a default seccomp profile, blocked privilege escalation and dropped Linux capabilities.

Why it didn’t stop

Hacktron’s harder question is whether this was mostly an alignment failure or also a jump in capability, and it reads as both. Its estimate is that a top human would need two to three weeks to get from that sandbox into Hugging Face’s internal infrastructure; the models did it in a single session, with a large inference budget and subagents, and Hacktron doubts any frontier model you can use today would finish the same chain in one run.

Why they went that far has two readings in the write-up: reward hacking - cheating an exam they could not pass - or goal drift, where “write an exploit for this challenge” slowly became “get the flag” across context compactions and subagent handoffs, with a subagent that never knew the original task’s boundaries. What they were chasing may not have been there at all: an on-site review by METR and Redwood Research concluded the agents built the operation to beat a scorer OpenAI never used.

The scale is on the record. The Cloud Security Alliance counts roughly 17,600 logged actions over the intrusion, which ran from about July 9 to July 13, and says the same agent activity also reached a second company, Modal Labs, through an exposed code-execution endpoint. Hugging Face described the fight in its incident report:

thousands of actions across a swarm of short-lived sandboxes, self-migrating command and control on public services, and lateral movement over an entire weekend.

Hacktron’s write-up ends on the model itself. A system that can find zero-days in Linux, WordPress and Chrome, it argues, “may be better than almost any human at the task in front of it, yet it still lacks the basic judgment of a child.”